Linux Kernel UDF Oversized CRC Length Vulnerability

A vulnerability in the Linux kernel's handling of Universal Disk Format (UDF) descriptors has been addressed. The issue arose because the function 'udf_read_tagged()' failed to properly verify the Cyclic Redundancy Check (CRC) when the descriptor's CRC length, plus the size of the tag structure, exceeded the block size. This oversight allowed a maliciously crafted UDF image to bypass CRC validation by setting an oversized CRC length, with the descriptor being accepted based only on a recomputable 8-bit tag checksum. The vulnerability has been fixed by rejecting such descriptors instead of accepting them silently.

Impact

Exploitation of this vulnerability could lead to the acceptance of UDF descriptors with invalid CRCs, potentially allowing for further manipulation or corruption of data.

Reproduction

The vulnerability can be reproduced by creating a UDF image that includes a descriptor with an oversized CRC length. This can be done by setting the CRC length to a value that exceeds the standard block size, effectively bypassing the CRC validation process. Once this crafted UDF image is processed by the Linux kernel, the vulnerability can be observed as the invalid descriptor is accepted without proper verification.

Remediation

Users can update to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for updating the Linux kernel can be found in the official Linux documentation or through the package management system of the respective Linux distribution.