Source: gfs2-utils Version: 3.6.1-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for gfs2-utils. Unfortunately the available information right now is limited to what we have in the references referring to Red Hat's bugzilla entries which do not contain upstream references. Could you plese invstigate the individual issues? CVE-2026-71219[0]: | A stack overflow vulnerability was found in gfs2-utils. The hash | table traversal code in metawalk.c uses alloca() with an | exponentially-derived size from the untrusted on-disk di_depth field | without bounds validation. A crafted GFS2 filesystem image with a | large di_depth value causes stack exhaustion and a denial of service | when processed by fsck.gfs2, gfs2_edit, or savemeta. CVE-2026-71220[1]: | A stack out-of-bounds write vulnerability was found in gfs2-utils. | In gfs2_edit, the di_height field from on-disk inode metadata is | used as an array index without bounds checking, causing a stack | buffer overflow that may lead to arbitrary code execution when | processing crafted GFS2 filesystem images. CVE-2026-71221[2]: | A stack out-of-bounds write vulnerability was found in gfs2-utils. | In savemeta, the height value from on-disk inode metadata is used as | a loop bound without bounds checking, causing a stack buffer | overflow that may lead to arbitrary code execution when processing | crafted GFS2 filesystem images. CVE-2026-71222[3]: | A heap out-of-bounds read vulnerability was found in gfs2-utils. The | ea_num_ptrs field from on-disk extended attribute metadata is | consumed without bounds validation, causing a heap buffer over-read | that may disclose sensitive memory contents or cause a crash when | processing crafted GFS2 filesystem images. CVE-2026-71223[4]: | gfs2-utils: integer overflow in resource group allocation size on 32- | bit platforms CVE-2026-71224[5]: | A stack overflow vulnerability was found in gfs2-utils. The metadata | walk code in metawalk.c uses alloca() with an untrusted inode height | value from on-disk metadata without bounds validation, causing stack | exhaustion and a denial of service when processing crafted GFS2 | filesystem images. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-71219 https://www.cve.org/CVERecord?id=CVE-2026-71219 [1] https://security-tracker.debian.org/tracker/CVE-2026-71220 https://www.cve.org/CVERecord?id=CVE-2026-71220 [2] https://security-tracker.debian.org/tracker/CVE-2026-71221 https://www.cve.org/CVERecord?id=CVE-2026-71221 [3] https://security-tracker.debian.org/tracker/CVE-2026-71222 https://www.cve.org/CVERecord?id=CVE-2026-71222 [4] https://security-tracker.debian.org/tracker/CVE-2026-71223 https://www.cve.org/CVERecord?id=CVE-2026-71223 [5] https://security-tracker.debian.org/tracker/CVE-2026-71224 https://www.cve.org/CVERecord?id=CVE-2026-71224 Regards, Salvatore
