Linux Kernel OCFS2 Oversized Group Bitmap Descriptor Vulnerability

A vulnerability in the Linux kernel's OCFS2 file system allows for the acceptance of oversized group bitmap descriptors. The issue arises because the validation function only checks bitmap bits against the parent allocator's chain geometry. This oversight enables a malicious descriptor to claim a size and bit count that exceeds the physical capacity of the group descriptor block. As a result, subsequent bitmap scans and updates can overwrite memory, leading to a use-after-free error. This vulnerability has been addressed by adding a physical capacity check that rejects descriptors exceeding the allowed size or bit count, while maintaining the original geometry check to ensure consistency between the on-disk layout and allocator metadata.

Impact

Exploitation of this vulnerability can cause a use-after-free condition, where freed memory is accessed, potentially leading to arbitrary code execution or memory corruption.

Reproduction

The vulnerability can be reproduced by creating a group bitmap descriptor that exceeds the physical limits of the group descriptor block. This can be done by manipulating the bg_size and bg_bits values to claim more space than is physically available, bypassing the existing validation checks. Once the oversized descriptor is accepted, it can be used to overwrite memory during bitmap operations, triggering the use-after-free error.

Remediation

Users can update to the latest patched version of the Linux kernel, where this vulnerability has been addressed. Instructions for updating the kernel can be found in the official Linux documentation.