| From bippy-1.2.0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@kernel.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2025-23150: ext4: fix off-by-one error in do_split |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| ext4: fix off-by-one error in do_split |
| |
| Syzkaller detected a use-after-free issue in ext4_insert_dentry that was |
| caused by out-of-bounds access due to incorrect splitting in do_split. |
| |
| BUG: KASAN: use-after-free in ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109 |
| Write of size 251 at addr ffff888074572f14 by task syz-executor335/5847 |
| |
| CPU: 0 UID: 0 PID: 5847 Comm: syz-executor335 Not tainted 6.12.0-rc6-syzkaller-00318-ga9cda7c0ffed #0 |
| Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 |
| Call Trace: |
| <TASK> |
| __dump_stack lib/dump_stack.c:94 [inline] |
| dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 |
| print_address_description mm/kasan/report.c:377 [inline] |
| print_report+0x169/0x550 mm/kasan/report.c:488 |
| kasan_report+0x143/0x180 mm/kasan/report.c:601 |
| kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 |
| __asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106 |
| ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109 |
| add_dirent_to_buf+0x3d9/0x750 fs/ext4/namei.c:2154 |
| make_indexed_dir+0xf98/0x1600 fs/ext4/namei.c:2351 |
| ext4_add_entry+0x222a/0x25d0 fs/ext4/namei.c:2455 |
| ext4_add_nondir+0x8d/0x290 fs/ext4/namei.c:2796 |
| ext4_symlink+0x920/0xb50 fs/ext4/namei.c:3431 |
| vfs_symlink+0x137/0x2e0 fs/namei.c:4615 |
| do_symlinkat+0x222/0x3a0 fs/namei.c:4641 |
| __do_sys_symlink fs/namei.c:4662 [inline] |
| __se_sys_symlink fs/namei.c:4660 [inline] |
| __x64_sys_symlink+0x7a/0x90 fs/namei.c:4660 |
| do_syscall_x64 arch/x86/entry/common.c:52 [inline] |
| do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 |
| entry_SYSCALL_64_after_hwframe+0x77/0x7f |
| </TASK> |
| |
| The following loop is located right above 'if' statement. |
| |
| for (i = count-1; i >= 0; i--) { |
| /* is more than half of this entry in 2nd half of the block? */ |
| if (size + map[i].size/2 > blocksize/2) |
| break; |
| size += map[i].size; |
| move++; |
| } |
| |
| 'i' in this case could go down to -1, in which case sum of active entries |
| wouldn't exceed half the block size, but previous behaviour would also do |
| split in half if sum would exceed at the very last block, which in case of |
| having too many long name files in a single block could lead to |
| out-of-bounds access and following use-after-free. |
| |
| Found by Linux Verification Center (linuxtesting.org) with Syzkaller. |
| |
| The Linux kernel CVE team has assigned CVE-2025-23150 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.4.61 with commit ea54176e5821936d109bb45dc2c19bd53559e735 and fixed in 5.4.293 with commit b96bd2c3db26ad0daec5b78c85c098b53900e2e1 |
| Issue introduced in 5.9 with commit 5872331b3d91820e14716632ebb56b1399b34fe1 and fixed in 5.10.237 with commit 515c34cff899eb5dae6aa7eee01c1295b07d81af |
| Issue introduced in 5.9 with commit 5872331b3d91820e14716632ebb56b1399b34fe1 and fixed in 5.15.181 with commit 2883e9e74f73f9265e5f8d1aaaa89034b308e433 |
| Issue introduced in 5.9 with commit 5872331b3d91820e14716632ebb56b1399b34fe1 and fixed in 6.1.135 with commit 35d0aa6db9d93307085871ceab8a729594a98162 |
| Issue introduced in 5.9 with commit 5872331b3d91820e14716632ebb56b1399b34fe1 and fixed in 6.6.88 with commit 2eeb1085bf7bd5c7ba796ca4119925fa5d336a3f |
| Issue introduced in 5.9 with commit 5872331b3d91820e14716632ebb56b1399b34fe1 and fixed in 6.12.24 with commit 16d9067f00e3a7d1df7c3aa9c20d214923d27e10 |
| Issue introduced in 5.9 with commit 5872331b3d91820e14716632ebb56b1399b34fe1 and fixed in 6.13.12 with commit 17df39f455f1289319d4d09e4826aa46852ffd17 |
| Issue introduced in 5.9 with commit 5872331b3d91820e14716632ebb56b1399b34fe1 and fixed in 6.14.3 with commit ab0cc5c25552ae0d20eae94b40a93be11b080fc5 |
| Issue introduced in 5.9 with commit 5872331b3d91820e14716632ebb56b1399b34fe1 and fixed in 6.15 with commit 94824ac9a8aaf2fb3c54b4bdde842db80ffa555d |
| Issue introduced in 4.4.234 with commit 059b1480105478c5f68cf664301545b8cad6a7cf |
| Issue introduced in 4.9.234 with commit 539ae3e03875dacaa9c388aff141ccbb4ef4ecb5 |
| Issue introduced in 4.14.195 with commit fbbfd55a40d5d0806b59ee0403c75d5ac517533f |
| Issue introduced in 4.19.142 with commit b3ddf6ba5e28a57729fff1605ae08e21be5c92e3 |
| Issue introduced in 5.7.18 with commit e50fe43e3062e18846e99d9646b9c07b097eb1ed |
| Issue introduced in 5.8.4 with commit 88e79f7a9841278fa8ff7ff6178bad12da002ffc |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2025-23150 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| fs/ext4/namei.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/b96bd2c3db26ad0daec5b78c85c098b53900e2e1 |
| https://git.kernel.org/stable/c/515c34cff899eb5dae6aa7eee01c1295b07d81af |
| https://git.kernel.org/stable/c/2883e9e74f73f9265e5f8d1aaaa89034b308e433 |
| https://git.kernel.org/stable/c/35d0aa6db9d93307085871ceab8a729594a98162 |
| https://git.kernel.org/stable/c/2eeb1085bf7bd5c7ba796ca4119925fa5d336a3f |
| https://git.kernel.org/stable/c/16d9067f00e3a7d1df7c3aa9c20d214923d27e10 |
| https://git.kernel.org/stable/c/17df39f455f1289319d4d09e4826aa46852ffd17 |
| https://git.kernel.org/stable/c/ab0cc5c25552ae0d20eae94b40a93be11b080fc5 |
| https://git.kernel.org/stable/c/94824ac9a8aaf2fb3c54b4bdde842db80ffa555d |
