lwest4 CVE-2025-70100 Divide By Zero Vulnerability

Vulnerability Overview Vulnerability Name: CVE-2025-70100 - Divide By Zero in lwest4 Vulnerability Type: Divide By Zero Vulnerability Description: When mounting or parsing a specially crafted EXT4 image that encodes a zero logical block size, lwest4 passes this invalid value to the function. The function performs arithmetic operations without validation, triggering a divide-by-zero error and causing a crash. Impact Scope Affected Components: - function - function Affected Product: lwest4 (Lightweight EXT4 file system library) Affected Versions: lwest4 1.0.0, commit 58bcf89a9121b72d4fb66334f1693d3b30e4cb9c5. The impact applies to versions based on or equivalent to the 2016 codebase. Attack Conditions: An attacker provides a specially crafted or corrupted EXT4 image to any application integrated with lwest4 for mounting or image processing. No privilege escalation is required; only local access (AVL) is needed to supply the malicious image. Remediation Remediation Status: This issue has been resolved in lwest4 v1.0.1, released by Aladdin-R-D. Users should upgrade to v1.0.1 or apply the corresponding patch. Proof of Concept (PoC) Code Additional Information Reporter: Alexander A. Shvedov (@sigdevel) & Daniil Dulov Publication Date: May 31, 2025, 07:28 PM Last Edited: May 31, 07:37 PM

Goal Reached Thanks to every supporter — we hit 100%!

lwest4 CVE-2025-70100 Divide By Zero Vulnerability