Executive brief
The Linux kernel's UDF file system contains a bug in the extent merging logic that can corrupt file metadata when handling very long extents. This could result in data loss, file system errors, or system instability for users accessing or creating files on UDF-formatted storage media.
Technical details
A logic error in the udf_merge_extents() function in fs/udf/inode.c causes file extent corruption when merging very long extents during inode metadata updates. The vulnerable code attempts to push length values into the first extent in a complex manner, leading to incorrect calculations that corrupt the extent list. The attack vector is local; an attacker or local user can trigger the bug by creating or manipulating files on a UDF-formatted file system. The patch simplifies the logic by avoiding extent merging when the combined length would exceed UDF_EXTENT_LENGTH_MASK, eliminating the buggy complex calculation.
Affected products
- Linux Linux kernel multiple versions across 2.6.x through 6.x stable branches
Timeline
- 2023-01-09: disclosed
- 2023-03-11: patched