REDHAT-BUG-2511398: Buffer Overflow
A flaw was found in gfs2-utils. In the gfs2edit tool, the metapathtolblock() function in extended.c uses the diheight field from on-disk inode metadata as an array index into a fixed-size stack array factor[GFS2MAXMETAHEIGHT] (10 elements) without bounds validation. An attacker can craft a GFS2 filesystem image with diheight exceeding 10 (up to 65535) to write past the end of the array, corrupting adjacent stack memory including saved registers and the return address. The subsequent loop (factor[h] = factor[h+1] sbd.sdinptrs) amplifies the corruption by writing additional entries past the array boundary. This is a classic stack buffer overflow that may allow arbitrary code execution when gfs2edit processes the crafted image. The Linux kernel GFS2 driver validates diheight against sdmaxheight in gfs2dinodein(), but the userspace gfs2-utils performs no equivalent validation.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to exploitation?
Systems are exposed when the userspace gfs2_edit tool processes a crafted GFS2 filesystem image. The described validation in the Linux kernel GFS2 driver does not provide equivalent protection in gfs2-utils.
What must an attacker provide to trigger the issue?
An attacker needs to supply a GFS2 filesystem image containing on-disk inode metadata with a di_height value greater than 10. When gfs2_edit processes that metadata, it can write beyond a fixed-size stack array.
What is the potential impact of successful exploitation?
The out-of-bounds writes can corrupt adjacent stack memory, including saved registers and the return address. This may permit arbitrary code execution in the context of gfs2_edit.