Linux Kernel F2FS Filesystem Out-of-Bounds Read Vulnerability via Inline Extended Attribute Size Manipulation

A vulnerability in the Linux kernel's F2FS filesystem allows for an out-of-bounds read caused by improper validation of inline extended attribute sizes. When the flexible inline extended attribute feature is enabled, the inode reader loads the inline attribute size without proper checks. This oversight can be exploited by crafting an image that manipulates the attribute size, leading to negative values that cause the filesystem to read beyond allocated buffers. The issue arises in inodes with inline data or directories that do not have the appropriate flags set, allowing for exploitation during directory reads.

Impact

Exploitation of this vulnerability causes a negative underflow that is promoted to a large unsigned value, leading to a read operation that exceeds the bounds of the inline data area. This out-of-bounds read occurs in the F2FS directory handling code, potentially allowing for the reading of arbitrary memory contents.

Reproduction

To reproduce this vulnerability, mount a crafted filesystem image on a Linux kernel version that has the flexible inline extended attribute feature enabled. The image should be prepared to include inodes with manipulated inline extended attribute sizes that are not properly checked by the filesystem. Once the image is mounted, navigate to an inline directory to trigger the out-of-bounds read condition.

Remediation

Users should update to the latest patched version of the Linux kernel where this vulnerability has been addressed.