Linux Kernel F2FS ACL Entry Size Validation Vulnerability

A vulnerability in the Linux kernel's F2FS file system allows for improper validation of Access Control List (ACL) entry sizes. The issue arises because the F2FS ACL counting function only checks the total length of the ACL extended attribute, leaving room for a malformed ACL to place user or group entries in a way that bypasses size checks. This flaw can lead to a 'slab-out-of-bounds' memory access, where the kernel reads beyond the allocated memory for short ACL entries, potentially causing memory corruption.

Impact

Exploitation of this vulnerability can lead to a 'slab-out-of-bounds' memory access, where the kernel reads beyond the allocated memory for short ACL entries. This type of memory access can often be exploited to cause a use-after-free condition or to overwrite memory, both of which can lead to arbitrary code execution or privilege escalation.

Reproduction

The vulnerability can be reproduced by creating a malformed ACL that places ACL_USER or ACL_GROUP entries in slots designated for short entries, such as 'struct f2fs_acl_entry_short' bytes. Once this malformed ACL is applied to a file or directory, the F2FS file system will incorrectly process the ACL entries. The vulnerability manifests as a KASAN (Kernel Address Sanitizer) report of a slab-out-of-bounds read, indicating that the kernel has accessed memory outside the bounds of what was allocated, specifically reading 4 bytes from an address that was just beyond an 8-byte allocated region.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been addressed. Instructions for downloading the patched version can be found in the Linux kernel documentation.