Executive brief
A vulnerability was identified in the Linux kernel's Squashfs file system, which is commonly used in embedded systems and read-only environments. An error in how the system handles file identifiers could allow a local user to trigger a system crash or potentially access restricted memory. This could lead to a loss of system availability or the exposure of sensitive information.
Technical details
An out-of-bounds access vulnerability exists in the Squashfs component of the Linux kernel, specifically within the fill_meta_index() function. The root cause is a failure to validate that an inode number is non-zero during inode creation. When a metadata read error occurs, the kernel sets the index's inode number to zero to mark it as unused; however, subsequent calls to locate_meta_index() may incorrectly return this uninitialized index if it encounters another inode with a value of zero. This leads to an out-of-bounds read when the kernel attempts to process the expected but missing metadata. The issue has been addressed by adding a sanity check in squashfs_new_inode() to return -EINVAL if an inode number of zero is encountered.
Affected products
- Linux Linux Kernel All versions prior to fixed stable releases (e.g., 6.8.x, 6.6.x, 6.1.x, 5.15.x, 5.10.x, 5.4.x, 4.19.x)
Timeline
- 2024-04-08: patched: Initial patch authored by Phillip Lougher
- 2024-05-01: disclosed: CVE-2024-26982 published
References
- https://git.kernel.org/stable/c/32c114a58236fe67141634774559f21f1dc96fd7
- https://git.kernel.org/stable/c/4a1b6f89825e267e156ccaeba3d235edcac77f94
- https://git.kernel.org/stable/c/5b99dea79650b50909c50aba24fbae00f203f013
- https://git.kernel.org/stable/c/7def00ebc9f2d6a581ddf46ce4541f84a10680e5
- https://git.kernel.org/stable/c/9253c54e01b6505d348afbc02abaa4d9f8a01395
- https://git.kernel.org/stable/c/be383effaee3d89034f0828038f95065b518772e
- https://git.kernel.org/stable/c/cf46f88b92cfc0e32bd8a21ba1273cff13b8745f