Executive brief
The HFS+ filesystem handler in the Linux kernel improperly validates catalog entry lengths when reading or writing inode data. A user mounting a malicious HFS+ filesystem image can trigger kernel panics through bogus entry length values, causing system unavailability and disrupting normal operations.
Technical details
The vulnerability exists in the hfsplus_cat_read_inode() and hfsplus_cat_write_inode() functions in fs/hfsplus/inode.c. The code used WARN_ON() assertions to check that file descriptor entry lengths were at least as large as the expected catalog structure sizes (hfsplus_cat_folder or hfsplus_cat_file). When processing a maliciously crafted HFS+ filesystem image with bogus entry length values, these assertions would trigger kernel panics. The fix replaces WARN_ON() with proper error handling (pr_err + EIO return code), allowing the kernel to gracefully reject invalid catalog entries instead of panicking. Attack vector requires local access to mount a crafted filesystem.
Affected products
- Linux Linux kernel affected versions with HFS+ support prior to patch commit 81b21c0f0138ff5a499eafc3eb0578ad2a99622c
Timeline
- 2023-04-11: disclosed
- 2023-05-24: patched: upstream commit 81b21c0f0138ff5a499eafc3eb0578ad2a99622c merged into stable trees