FatFs Multiple CVEs Analysis: Integer Overflow, Stack Overflow, Info Leak

Vulnerability Overview This webpage summarizes seven vulnerabilities in the FatFs project, with severity levels ranging from CVSS Medium to High. The primary issues include: 1. FAT32 Integer Overflow in - CVE ID: CVE-2024-6682 - Description: An integer overflow in the core mount arithmetic can cause attacker-controlled file size metadata to be misinterpreted as a read length, leading to a stack overflow and arbitrary code execution. 2. exFAT Label Length Stack Overflow in - CVE ID: CVE-2024-6687 - Description: The exFAT label length field is not properly truncated, causing a write to the caller-provided label buffer, which may result in a stack overflow. 3. Long Filename Overflow in Downstream Calls - CVE ID: CVE-2024-6685 - Description: When Long Filename (LFN) is enabled, filenames may be significantly larger than expected by many caller buffers, leading to buffer overflows. 4. Unsigned Subtraction Wraparound in Dirty-Cache Handling - CVE ID: CVE-2024-6685 - Description: On fragmented volumes, arithmetic wraparound can lead to dirty cache behaviors and out-of-bounds memory effects, manifesting as silent data corruption. 5. exFAT Division by Zero in Sync/Write Path - CVE ID: CVE-2024-6683 - Description: A division-by-zero condition in the exFAT sync/write stream can cause crash behaviors, serving as a practical bricking vector. 6. Uninitialized Cluster Exposure Beyond EOF - CVE ID: CVE-2024-6686 - Description: Extended files beyond the End of File (EOF) may expose uninitialized clusters from previously deleted data, leading to information leakage. 7. GPT Partition Scan Loop DoS (pre-RO.16) - CVE ID: CVE-2024-6684 - Description: Abuse of the GPT entry count can lead to unbounded scans, causing a severe Denial of Service (DoS) during mounting. Impact Scope These vulnerabilities affect a broad ecosystem, including Espressif ESP-IDF, STMicroelectronics STM32Cube Middleware, Zephyr RTOS, MicroPython, Arduino, RT-Thread, Mbed, Samsung TizenRT, and SWUpdate. Downstream applications include consumer IoT devices, industrial controllers, drones, encrypted wallets, and more. Remediation FAT32 Integer Overflow: Fix the integer overflow issue in the core mount arithmetic. exFAT Label Length Stack Overflow: Properly truncate the exFAT label length field. Long Filename Overflow: Ensure filename lengths stay within the bounds of the caller's buffer. Unsigned Subtraction Wraparound: Fix the arithmetic wraparound issue in dirty-cache handling. exFAT Division by Zero: Prevent division-by-zero conditions in the sync/write stream. Uninitialized Cluster Exposure: Prevent the leakage of uninitialized data when extending files beyond EOF. GPT Partition Scan Loop DoS: Limit GPT entry counts to prevent unbounded scans. Proof of Concept (POC) or Exploit Code Specific POC code or exploit code is not provided on the page; however, a complete QEMU-based exploit example and corrupted FatFs images are available in the GitHub repository: Summary The remediation of these vulnerabilities requires updates from the FatFs project maintainers. Downstream implementers should audit their versions, wrappers, and handling of filenames and file sizes, and plan for patch updates. Given the widespread usage of FatFs and the lack of timely response, it is recommended to take security precautions as soon as possible.

Goal Reached Thanks to every supporter — we hit 100%!

FatFs Multiple CVEs Analysis: Integer Overflow, Stack Overflow, Info Leak