Linux kernel MDT AFS v2 parser OOB read fix: validate image info bounds

Vulnerability Key Information Summary Vulnerability Overview Submission Title: Problem Description: The AFS v2 parser uses as the offset of the image information block within the . However, this value is derived from flash content and was not validated against the or the local array boundaries, which could lead to out-of-bounds access. Remediation: Reject image information block offsets that the array cannot accommodate, and perform boundary validation before iterating through region entries. Affected Scope Affected File: Affected Component: AFS v2 partition parser ( ) Risk Type: Out-of-bounds read/write (OOB), potentially leading to memory corruption or information disclosure. Fix Proposal Add boundary checks when parsing : - Verify that is less than - Verify that the array capacity is sufficient to accommodate entries - Return if the validation fails POC / Key Code Snippet (from diff) ```c / First read the footer / ptr = off + mdt->version; ptr = off + mdt->version; if (footer[8] > sizeof(footer)) return -EINVAL; / First read the footer / ptr = off + mdt->version; version = footer[8]; if (footer[8] > sizeof(footer)) return -EINVAL; ptr = off + mdt->version; name = (char ) &footer[8]; version = footer[8]; if (footer[8] > sizeof(footer)) return -EINVAL; ptr = off + mdt->version; name = (char ) &footer[8]; version = footer[8]; if (footer[8] > sizeof(footer)) return -EINVAL; ptr = off + mdt->version; name = (char ) &footer[8]; version = footer[8]; if (footer[8] > sizeof(footer)) return -EINVAL; ptr = off + mdt->version; name = (char ) &footer[8]; version = footer[8]; if (footer[8] > sizeof(footer)) return -EINVAL; ptr = off + mdt->version; name = (char ) &footer[8]; version = footer[8]; if (footer[8] > sizeof(footer)) return -EINVAL; ptr = off + mdt->version; name = (char ) &footer[8]; version = footer[8]; if (footer[8] > sizeof(footer)) return -EINVAL; ptr = off + mdt->version; name = (char ) &footer[8]; version = footer[8]; if (footer[8] > sizeof(footer)) return -EINVAL; ptr = off + mdt->version; name = (char ) &footer[8]; version = footer[8]; if (footer[8] > sizeof(footer)) return -EINVAL; ptr = off + mdt->version; name = (char ) &footer[8]; version = footer[8]; if (footer[8] > sizeof(footer)) return -EINVAL; ptr = off + mdt->version; name = (char ) &footer[8]; version = footer[8]; if (footer[8] > sizeof(footer)) return -EINVAL; ptr = off + mdt->version; name = (char ) &footer[8]; version = footer[8]; if (footer[8] > sizeof(footer)) return -EINVAL; ptr = off + mdt->version; name = (char ) &footer[8]; version = footer[8]; if (footer[8] > sizeof(footer)) return -EINVAL; ptr = off + mdt->version; name = (char ) &footer[8]; version = footer[8]; if (footer[8] > sizeof(footer)) return -EINVAL; ptr = off + mdt->version; name = (char ) &footer[8]; version = footer[8]; if (footer[8] > sizeof(footer)) return -EINVAL; ptr = off + mdt->version; name = (char ) &footer[8]; version = footer[8]; if (footer[8] > sizeof(footer)) return -EINVAL; ptr = off + mdt->version; name = (char ) &footer[8]; version = footer[8]; if (footer[8] > sizeof(footer)) return -EINVAL; ptr = off + mdt->version; name = (char ) &footer[8]; version = footer[8]; if (footer[8] > sizeof(footer)) return -EINVAL; ptr = off + mdt->version; name = (char ) &footer[8]; version = footer[8]; if (footer[8] > sizeof(footer)) return -EINVAL; ptr = off + mdt->version; name = (char ) &footer[8]; version = footer[8]; if (footer[8] > sizeof(footer)) return -EINVAL; ptr = off + mdt->version; name = (char ) &footer[8]; version = footer[8]; if (footer[8] > sizeof(footer)) return -EINVAL; ptr = off + mdt->version; name = (char ) &footer[8]; version = footer[8]; if (footer[8] > sizeof(footer)) return -EINVAL; ptr = off + mdt->version; name = (char ) &footer[8]; version = footer[8]; if (footer[8] > sizeof(footer)) return -EINVAL; ptr = off + mdt->version; name = (char ) &footer[8]; version = footer[8]; if (footer[8] > sizeof(footer)) return -EINVAL; ptr = off + mdt->version; name = (char ) &footer[8]; version = footer[8]; if (footer[8] > sizeof(footer)) return -EINVAL; ptr = off + mdt->version; name = (char ) &footer[8]; version = footer[8]; if (footer[8] > sizeof(footer)) return -EINVAL; ptr = off + mdt->version; name = (char ) &footer[8]; version = footer[8]; if (footer[8] > sizeof(footer)) return -EINVAL; ptr = off + mdt->version; name = (char ) &footer[8]; version = footer[8]; if (footer[8] > sizeof(footer)) return -EINVAL; ptr = off + mdt->version; name = (char ) &footer[8]; version = footer[8]; if (footer[8] > sizeof(footer)) return -EINVAL; ptr = off + mdt->version; name = (char ) &footer[8]; version = footer[8]; if (footer[8] > sizeof(footer)) return -EINVAL; ptr = off + mdt->version; name = (char ) &footer[8]; version = footer[8]; if (footer[8] > sizeof(footer)) return -EINVAL; ptr = off + mdt->version; name = (char ) &footer[8]; version = footer[8]; if (footer[8] > sizeof(footer)) return -EINVAL; ptr = off + mdt->version; name = (char ) &footer[8]; version = foo

Goal Reached Thanks to every supporter — we hit 100%!

Linux kernel MDT AFS v2 parser OOB read fix: validate image info bounds

More from this source