Executive brief
gfs2-utils is a utility for managing GFS2 (Global File System 2) filesystem images, often used by system administrators. A flaw in the gfs2_edit tool allows attackers to trigger a stack buffer overflow by crafting a malicious GFS2 filesystem image with a specially crafted inode metadata field. An administrator who processes such an image could allow an attacker to execute arbitrary code with their privileges.
Technical details
The vulnerability is a stack out-of-bounds write (CWE-787) in gfs2_edit, where the di_height field from on-disk GFS2 inode metadata is used as an array index without bounds checking. This causes a controlled stack buffer overflow that can corrupt the stack, including return addresses. An attacker can craft a malicious GFS2 filesystem image to trigger the overflow. Exploitation requires local access and user interaction (an administrator must run gfs2_edit on the crafted image). The kernel GFS2 driver is not affected because it validates di_height against sd_max_height, but userspace tools are vulnerable. System hardening features (stack-protector, PIE, ASLR) provide partial mitigation but do not prevent exploitation.
Affected products
- Red Hat gfs2-utils
Timeline
- 2026-09-03: disclosed