UBUNTU-CVE-2024-53234: Security vulnerability
In the Linux kernel, the following vulnerability has been resolved: erofs: handle NONHEAD !delta[1] lclusters gracefully syzbot reported a WARNING in iomapiterdone: iomapfiemap+0x73b/0x9b0 fs/iomap/fiemap.c:80 ioctlfiemap fs/ioctl.c:220 [inline] Generally, NONHEAD lclusters won't have delta[1]==0, except for crafted images and filesystems created by pre-1.0 mkfs versions. Previously, it would immediately bail out if delta[1]==0, which led to inadequate decompressed lengths (thus FIEMAP is impacted). Treat it as delta[1]=1 to work around these legacy mkfs versions. lclusterbits > 14 is illegal for compact indexes, error out too.
Event History
Frequently Asked Questions
Which systems are most likely to encounter this issue?
Systems mounting EROFS images with crafted metadata or filesystems created by pre-1.0 mkfs versions are the relevant exposure cases. The described impact occurs when FIEMAP processes affected compressed logical clusters.
What condition triggers the faulty behavior?
A NONHEAD lcluster with delta[1] equal to zero triggers the problematic path. Such a value is unexpected in normal images but can occur in crafted images and legacy pre-1.0 mkfs output.
What is the observed impact?
The kernel can emit a WARNING in iomap_iter_done during FIEMAP handling because it calculates an inadequate decompressed length. Compact indexes with lclusterbits greater than 14 are also invalid and should be rejected.
What mitigation is indicated when affected legacy filesystem images must be used?
The resolution handles NONHEAD clusters with delta[1] equal to zero as though delta[1] were 1, providing compatibility for legacy mkfs output. Invalid compact indexes with lclusterbits greater than 14 should be treated as errors rather than accepted.