Executive brief
The Linux kernel's HFS (Hierarchical File System) implementation contains an out-of-bounds memory read vulnerability in filename handling. When a corrupted or malicious HFS filesystem image with invalid filename length values is mounted or accessed, the kernel can read memory beyond allocated buffer boundaries. This could allow an attacker to leak sensitive kernel memory contents.
Technical details
The vulnerability is a classic out-of-bounds (OOB) read in the HFS B-tree search code. The root cause is insufficient validation of the filename length field (len) in hfs_name structures; when len exceeds HFS_NAMELEN (31 bytes), the hfs_strcmp() function reads past allocated buffer boundaries. The vulnerable code path is: hfs_write_inode() → hfs_brec_find() → __hfs_brec_find() → hfs_strcmp(). The flaw requires an attacker to provide a malformed HFS filesystem with crafted inode metadata, typically via mounting a specially-crafted disk image. No user authentication is required; the attack triggers during filesystem inode writeback. The fix adds explicit validation checking that len does not exceed HFS_NAMELEN before proceeding with the B-tree search. Patch commits 8d824e69d9f3 (mainline) and 2344f17c0a89 (stable) are available.
Affected products
- Linux Linux kernel All versions prior to fix (patch commit 8d824e69d9f3)
Timeline
- 2022-11-30: disclosed
- 2023-01-18: patched: Patch 2344f17c0a89 merged to stable trees