REDHAT-BUG-2511399: Medium severity gfs2-utils vulnerability
A flaw was found in gfs2-utils. The eanumptrs field from on-disk extended attribute metadata is used as a loop count in savemeta.c and metawalk.c without bounds validation. The eanumptrs field is a u8 (max 255). Each iteration reads a pointer (8 bytes) plus name data. With eanumptrs=255 and a 512-byte block buffer, the loop reads up to 1384 bytes past the buffer boundary, causing a heap out-of-bounds read. This may disclose sensitive heap memory contents through tool output or error messages, and the significant over-read (2.7x the allocation) has a non-trivial probability of crossing a page boundary into unmapped memory, causing a crash.
Affected Software
Event History
Frequently Asked Questions
What would an attacker need to exploit this flaw?
An attacker would need to supply or cause the tools to process GFS2 filesystem metadata containing a crafted extended-attribute ea_num_ptrs value. The affected code uses this on-disk value as a loop count without validating it against the block-buffer size.
What is the practical impact during analysis or recovery operations?
Processing malicious metadata can make the tool read heap memory beyond its allocated block buffer. Sensitive heap contents may be exposed in tool output or error messages, and the over-read can also reach unmapped memory and crash the tool.
How can administrators identify potentially malicious metadata?
The problematic condition is an extended-attribute metadata ea_num_ptrs value that is excessively large, such as 255. The available information does not provide a command or detection procedure for finding such values.