Hi all,
On 6/25/26 10:08 AM, Richard GENOUD wrote:
Hi Piyush,
Le 12/06/2026 à 09:54, Piyush Paliwal a écrit :
Two independent out-of-bounds reads in the SquashFS driver, both
reachable
by pointing U-Boot at an attacker-supplied image (e.g. ls/load on a
crafted
USB/SD/netboot rootfs). Either one crashes the bootloader (DoS); patch
2 can
also copy adjacent heap memory into the loaded file (information
disclosure).
1/2 sqfs_find_inode()/sqfs_inode_size() walk the decompressed inode
table
using on-disk sizes with no check that the cursor stays inside the
buffer -> wild read / SEGV, e.g. from a simple "ls".
2/2 sqfs_read_nest() uses the on-disk fragment offset as an unbounded
source index into the fragment block -> out-of-bounds heap read
when
loading a fragment-backed file.
Both were found by fuzzing the sandbox build (CONFIG_ASAN) of sqfsls/
sqfsload
with mutated images. With the fixes, the crashing inputs are rejected
cleanly, 2000 fuzz iterations produce no further crashes, and the
valid-image
path is unchanged.
These are distinct from the 2024 SquashFS CVE cluster
(CVE-2024-57254..57259,
fixed in 2025.01-rc1) and from the sqfs_frag_lookup() fix
(e365a269df5): the
earlier work added NULL checks at the callers and fixed the symlink-
size and
fragment-table paths, but left these inode-table-walk and fragment-data
paths unbounded.
The two patches are independent and can be applied in either order.
Piyush Paliwal (2):
fs/squashfs: bound the inode table walk in sqfs_find_inode()
fs/squashfs: bound fragment offset/size in sqfs_read_nest()
fs/squashfs/sqfs.c | 50 ++++++++++++----
fs/squashfs/sqfs_filesystem.h | 6 +-
fs/squashfs/sqfs_inode.c | 106 +++++++++++++++++++++++++++++-----
3 files changed, 134 insertions(+), 28 deletions(-)
Those patches look good.
NB: a patch correcting the same issue as patch 1 was sent 12 hours
earlier by Hem Parekh, but it fixes less problems than this one.
Reviewed-by: Richard Genoud <[email protected]>
Going through my inbox and stumbled upon this here. I see Richard is one
of the custodians but I don't see a custodian tree specific to squashfs
in MAINTAINERS. In patchwork, this series is delegated to Tom. I have
not reviewed any of it so this isn't a push for "hitting the merge
button", just trying to make sure it doesn't get forgotten :)
@Piyush, please refrain from adding Cc: [email protected] to your
commit logs. 1) This is U-Boot and not the Linux kernel so it's adding
noise they don't need. 2) We don't do stable releases in U-Boot.
Cheers,
Quentin
