Hello,
This is a short note on the security issue behind the patch we sent
today (Message-ID:
<[email protected]>).
In set_fatent_value(), getsize is a signed int. The existing "cap
length if fatlength is not a multiple of FATBUFBLOCKS" line
underflows when startblock > fatlength (getsize = fatlength -
startblock, both __u32). The wrapped value is passed to disk_read()
as the block count. disk_read() has no bound of its own, so a
crafted FAT (tiny fatlength from the BPB, plus a directory entry
with a large start cluster) makes the block layer read far past the
fixed 3072-byte fatbuf -- a heap out-of-bounds write of attacker
disk contents. The path is reached by overwriting an existing file
with a smaller one (set_contents() truncation).
That is a controlled-content out-of-bounds write. We score the
proven impact as CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H =
7.1.
This is a missing sibling of CVE-2025-24857. 87d85139a96a ("fs:
fat: Perform sanity checks on getsize in get_fatent()") added the
same clamp on the read path in fs/fat/fat.c only. The identical
cache-fill in fs/fat/fat_write.c was never touched. A clamp that
lives only in get_fatent() does not close this site.
flush_dirty_fat_buffer() has the same getsize computation feeding
disk_write(); that path fails safe today via the write overflow
check, and the posted patch bounds both sites.
On QEMU-TCG the same spray can be steered into bootloader code
execution: TCG re-translates DMA-written code pages, so the
overwrite of the relocated image becomes fetchable. That is an
emulator property, not something we score for hardware. Physical
ARM64 keeps executing cached .text after a DMA write (no icache
maintenance from the image), so the expected hardware outcome
remains the heap overwrite and a crash or reset.
Affected: CONFIG_FAT_WRITE (not enabled by sandbox_defconfig or
qemu_arm64_defconfig; shipped in roughly two dozen in-tree
defconfigs). The posted patch makes getsize unsigned and clamps it
to FATBUFBLOCKS before the transfer, as get_fatent() already does.
We are not attaching a PoC. Happy to answer review comments on the
patch.
Thanks,
Shubham Antil
Octane Security
