Linux Kernel exFAT Filesystem Use-After-Free Vulnerability in Directory Entry Handling

A use-after-free vulnerability has been identified in the Linux kernel's exFAT filesystem implementation, specifically within the directory entry handling function, exfat_find_dir_entry(). The issue arises because the function releases a buffer containing directory entry data before it has finished reading the information, particularly when processing extended entries. This can lead to undefined behavior, as the memory may be reused before the data is fully processed. The vulnerability was confirmed on a QEMU x86_64 environment with specific kernel configurations that enabled memory debugging features, using a crafted exFAT image designed to exploit the flaw.

Impact

Exploitation of this vulnerability can lead to a use-after-free condition, where the program attempts to access memory that has already been freed. This can cause crashes or potentially allow for arbitrary code execution under certain circumstances.

Reproduction

The vulnerability can be reproduced by creating a long filename exFAT image that causes hash collisions, forcing the exfat_find_dir_entry() function to follow the TYPE_EXTEND path. When this crafted image is processed, the unpatched kernel will crash due to the use-after-free error, as indicated by the KASAN (Kernel Address Sanitizer) report of a memory access violation.

Remediation

Users can upgrade to the latest stable version of the Linux kernel, where this vulnerability has been addressed. The specific commit that fixes this issue is available in the Linux kernel stable tree.