| From bippy-1.2.0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@kernel.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2025-37785: ext4: fix OOB read when checking dotdot dir |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| ext4: fix OOB read when checking dotdot dir |
| |
| Mounting a corrupted filesystem with directory which contains '.' dir |
| entry with rec_len == block size results in out-of-bounds read (later |
| on, when the corrupted directory is removed). |
| |
| ext4_empty_dir() assumes every ext4 directory contains at least '.' |
| and '..' as directory entries in the first data block. It first loads |
| the '.' dir entry, performs sanity checks by calling ext4_check_dir_entry() |
| and then uses its rec_len member to compute the location of '..' dir |
| entry (in ext4_next_entry). It assumes the '..' dir entry fits into the |
| same data block. |
| |
| If the rec_len of '.' is precisely one block (4KB), it slips through the |
| sanity checks (it is considered the last directory entry in the data |
| block) and leaves "struct ext4_dir_entry_2 *de" point exactly past the |
| memory slot allocated to the data block. The following call to |
| ext4_check_dir_entry() on new value of de then dereferences this pointer |
| which results in out-of-bounds mem access. |
| |
| Fix this by extending __ext4_check_dir_entry() to check for '.' dir |
| entries that reach the end of data block. Make sure to ignore the phony |
| dir entries for checksum (by checking name_len for non-zero). |
| |
| Note: This is reported by KASAN as use-after-free in case another |
| structure was recently freed from the slot past the bound, but it is |
| really an OOB read. |
| |
| This issue was found by syzkaller tool. |
| |
| Call Trace: |
| [ 38.594108] BUG: KASAN: slab-use-after-free in __ext4_check_dir_entry+0x67e/0x710 |
| [ 38.594649] Read of size 2 at addr ffff88802b41a004 by task syz-executor/5375 |
| [ 38.595158] |
| [ 38.595288] CPU: 0 UID: 0 PID: 5375 Comm: syz-executor Not tainted 6.14.0-rc7 #1 |
| [ 38.595298] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 |
| [ 38.595304] Call Trace: |
| [ 38.595308] <TASK> |
| [ 38.595311] dump_stack_lvl+0xa7/0xd0 |
| [ 38.595325] print_address_description.constprop.0+0x2c/0x3f0 |
| [ 38.595339] ? __ext4_check_dir_entry+0x67e/0x710 |
| [ 38.595349] print_report+0xaa/0x250 |
| [ 38.595359] ? __ext4_check_dir_entry+0x67e/0x710 |
| [ 38.595368] ? kasan_addr_to_slab+0x9/0x90 |
| [ 38.595378] kasan_report+0xab/0xe0 |
| [ 38.595389] ? __ext4_check_dir_entry+0x67e/0x710 |
| [ 38.595400] __ext4_check_dir_entry+0x67e/0x710 |
| [ 38.595410] ext4_empty_dir+0x465/0x990 |
| [ 38.595421] ? __pfx_ext4_empty_dir+0x10/0x10 |
| [ 38.595432] ext4_rmdir.part.0+0x29a/0xd10 |
| [ 38.595441] ? __dquot_initialize+0x2a7/0xbf0 |
| [ 38.595455] ? __pfx_ext4_rmdir.part.0+0x10/0x10 |
| [ 38.595464] ? __pfx___dquot_initialize+0x10/0x10 |
| [ 38.595478] ? down_write+0xdb/0x140 |
| [ 38.595487] ? __pfx_down_write+0x10/0x10 |
| [ 38.595497] ext4_rmdir+0xee/0x140 |
| [ 38.595506] vfs_rmdir+0x209/0x670 |
| [ 38.595517] ? lookup_one_qstr_excl+0x3b/0x190 |
| [ 38.595529] do_rmdir+0x363/0x3c0 |
| [ 38.595537] ? __pfx_do_rmdir+0x10/0x10 |
| [ 38.595544] ? strncpy_from_user+0x1ff/0x2e0 |
| [ 38.595561] __x64_sys_unlinkat+0xf0/0x130 |
| [ 38.595570] do_syscall_64+0x5b/0x180 |
| [ 38.595583] entry_SYSCALL_64_after_hwframe+0x76/0x7e |
| |
| The Linux kernel CVE team has assigned CVE-2025-37785 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 2.6.19 with commit ac27a0ec112a089f1a5102bc8dffc79c8c815571 and fixed in 5.4.293 with commit 14da7dbecb430e35b5889da8dae7bef33173b351 |
| Issue introduced in 2.6.19 with commit ac27a0ec112a089f1a5102bc8dffc79c8c815571 and fixed in 5.10.236 with commit e47f472a664d70a3d104a6c2a035cdff55a719b4 |
| Issue introduced in 2.6.19 with commit ac27a0ec112a089f1a5102bc8dffc79c8c815571 and fixed in 5.15.180 with commit b7531a4f99c3887439d778afaf418d1a01a5f01b |
| Issue introduced in 2.6.19 with commit ac27a0ec112a089f1a5102bc8dffc79c8c815571 and fixed in 6.1.134 with commit 89503e5eae64637d0fa2218912b54660effe7d93 |
| Issue introduced in 2.6.19 with commit ac27a0ec112a089f1a5102bc8dffc79c8c815571 and fixed in 6.6.87 with commit 52a5509ab19a5d3afe301165d9b5787bba34d842 |
| Issue introduced in 2.6.19 with commit ac27a0ec112a089f1a5102bc8dffc79c8c815571 and fixed in 6.12.23 with commit b47584c556444cf7acb66b26a62cbc348eb92b78 |
| Issue introduced in 2.6.19 with commit ac27a0ec112a089f1a5102bc8dffc79c8c815571 and fixed in 6.13.11 with commit ac28c5684c1cdab650a7e5065b19e91577d37a4b |
| Issue introduced in 2.6.19 with commit ac27a0ec112a089f1a5102bc8dffc79c8c815571 and fixed in 6.14.2 with commit 53bc45da8d8da92ec07877f5922b130562eb4b00 |
| Issue introduced in 2.6.19 with commit ac27a0ec112a089f1a5102bc8dffc79c8c815571 and fixed in 6.15 with commit d5e206778e96e8667d3bde695ad372c296dc9353 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2025-37785 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| fs/ext4/dir.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/14da7dbecb430e35b5889da8dae7bef33173b351 |
| https://git.kernel.org/stable/c/e47f472a664d70a3d104a6c2a035cdff55a719b4 |
| https://git.kernel.org/stable/c/b7531a4f99c3887439d778afaf418d1a01a5f01b |
| https://git.kernel.org/stable/c/89503e5eae64637d0fa2218912b54660effe7d93 |
| https://git.kernel.org/stable/c/52a5509ab19a5d3afe301165d9b5787bba34d842 |
| https://git.kernel.org/stable/c/b47584c556444cf7acb66b26a62cbc348eb92b78 |
| https://git.kernel.org/stable/c/ac28c5684c1cdab650a7e5065b19e91577d37a4b |
| https://git.kernel.org/stable/c/53bc45da8d8da92ec07877f5922b130562eb4b00 |
| https://git.kernel.org/stable/c/d5e206778e96e8667d3bde695ad372c296dc9353 |
