Executive brief
A vulnerability in the Linux kernel's handling of Macintosh-style partition tables could allow a local attacker to cause a system crash or potentially gain unauthorized access to memory. By presenting the system with a specially crafted or 'bogus' partition table—such as from a malicious USB drive—an attacker can trigger memory errors during the disk probing process. This affects systems that attempt to read and mount legacy Mac partition formats.
Technical details
Multiple flaws exist in the 'partitions/mac.c' component of the Linux kernel during partition probing. Specifically, the code failed to validate sector sizes (allowing non-power-of-two values that cause entries to straddle boundaries), lacked proper NUL termination checks for partition names (using strlen/strcmp instead of strnlen/strncmp), and failed to properly release device sectors during certain error bailouts. A local attacker with the ability to present a malformed disk image or physical device can trigger an out-of-bounds read or write (CWE-787). Patches have been released across various stable kernel branches to enforce power-of-two sector sizes and safer string handling.
Affected products
- Linux Linux Kernel up to 5.4.291, 5.5 to 5.10.235, 5.11 to 5.15.179, 5.16 to 6.1.129, 6.2 to 6.6.79, 6.7 to 6.12.16, 6.13 to 6.13.4, 6.14-rc1, 6.14-rc2
Timeline
- 2025-02-14: patched: Initial patch authored by Jann Horn
- 2025-02-27: disclosed: CVE published
References
- https://git.kernel.org/stable/c/213ba5bd81b7e97ac6e6190b8f3bc6ba76123625
- https://git.kernel.org/stable/c/27a39d006f85e869be68c1d5d2ce05e5d6445bf5
- https://git.kernel.org/stable/c/40a35d14f3c0dc72b689061ec72fc9b193f37d1f
- https://git.kernel.org/stable/c/6578717ebca91678131d2b1f4ba4258e60536e9f
- https://git.kernel.org/stable/c/7fa9706722882f634090bfc9af642bf9ed719e27
- https://git.kernel.org/stable/c/80e648042e512d5a767da251d44132553fe04ae0
- https://git.kernel.org/stable/c/92527100be38ede924768f4277450dfe8a40e16b