REDHAT-BUG-2511396: Buffer Overflow
A flaw was found in gfs2-utils. In the savemeta function in savemeta.c, the height value from on-disk inode metadata controls a loop over a fixed-size stack array (10 elements) without bounds validation. An attacker can craft a GFS2 filesystem image with a height value exceeding 10 to write past the end of the array, corrupting adjacent stack memory. This is the same vulnerability class as the diheight OOB write in gfs2edit (extended.c) but in a different code path. The stack buffer overflow may allow arbitrary code execution when savemeta processes the crafted image. The Linux kernel GFS2 driver validates iheight against sdmaxheight in gfs2dinodein(), but the userspace gfs2-utils performs no equivalent validation.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems are exposed when the gfs2-utils savemeta function processes a GFS2 filesystem image from an untrusted source. The issue is in the userspace utility's metadata handling path.
What does an attacker need to exploit it?
An attacker needs to provide a crafted GFS2 filesystem image whose on-disk inode metadata contains a height value greater than 10, and have savemeta process that image.
Does the Linux kernel's GFS2 validation prevent this overflow?
No. The kernel GFS2 driver validates i_height against sd_max_height, but the affected gfs2-utils savemeta code does not perform equivalent validation.
What can be done before a fix is available?
Avoid using savemeta on untrusted or externally supplied GFS2 filesystem images. Treat images with unvalidated inode metadata as unsafe to process with the affected userspace utility.