138 lines
8.7 KiB
JSON
138 lines
8.7 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2025-40241",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2025-04-16T07:20:57.181Z",
|
|
"datePublished": "2025-12-04T15:31:30.594Z",
|
|
"dateUpdated": "2026-08-05T12:08:45.194Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T12:08:45.194Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix crafted invalid cases for encoded extents\n\nRobert recently reported two corrupted images that can cause system\ncrashes, which are related to the new encoded extents introduced\nin Linux 6.15:\n\n - The first one [1] has plen != 0 (e.g. plen == 0x2000000) but\n (plen & Z_EROFS_EXTENT_PLEN_MASK) == 0. It is used to represent\n special extents such as sparse extents (!EROFS_MAP_MAPPED), but\n previously only plen == 0 was handled;\n\n - The second one [2] has pa 0xffffffffffdcffed and plen 0xb4000,\n then \"cur [0xfffffffffffff000] += bvec.bv_len [0x1000]\" in\n \"} while ((cur += bvec.bv_len) < end);\" wraps around, causing an\n out-of-bound access of pcl->compressed_bvecs[] in\n z_erofs_submit_queue(). EROFS only supports 48-bit physical block\n addresses (up to 1EiB for 4k blocks), so add a sanity check to\n enforce this."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The vulnerable data comes from an on-disk erofs extent record, and the bug is triggered by a local `read()`/`mmap()`/readahead on a file in a mounted erofs image via `z_erofs_aops.read_folio`. There is no network-facing service that reaches `z_erofs_map_blocks_ext()`.\nAC:L - Both `m_pa` and `m_plen` are read verbatim from the crafted image, so the attacker deterministically chooses the values that make `cur + pageofs_in + pclustersize` wrap; no race, timing window, or uncontrollable memory layout is involved. Robert Morris reproduced both cases with plain image files.\nPR:L - Once the image is mounted, any unprivileged user with read access to a file triggers the path — there is no capability check on `read_folio → z_erofs_scan_folios → z_erofs_pcluster_begin → z_erofs_submit_queue`. On Android and container hosts the attacker-supplied erofs image is mounted by the platform itself, so the attacker needs only ordinary local access.\nUI:N - In the deployments where erofs carries untrusted data (Android system/APEX/OTA images, container layers over fscache/composefs, file-backed mounts), the image is mounted automatically with no human action, and the attacker then triggers the bug with their own `read()`. No victim must open a file or insert media.\nS:U - The out-of-bounds accesses to `pcl->compressed_bvecs[]` and the oversized bio_vec target the host kernel's own heap and page allocations. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - `z_erofs_fill_bio_vec()` reads a `struct z_erofs_bvec` from beyond the pcluster slab object and dereferences its `.page` as a real `struct page *` (`page_folio()`, `folio->private`, `folio->mapping`), giving an attacker-steerable kernel read; the oversized bio_vec additionally makes the kernel treat memory past a single page as an I/O buffer whose contents the decompressor copies into page-cache folios readable from userspace.\nI:H - `pcl->compressed_bvecs[nr].page = page` in `z_erofs_fill_bio_vec()` stores a kernel pointer past the end of the pcluster slab object at an attacker-influenced index, and the expanded `bvec.bv_len = end - cur` (up to ~1 MiB on one order-0 page) lets `vfs_iocb_iter_read()` in `erofs_fileio_rq_submit()` write attacker-controlled image bytes linearly over adjacent memory — a full heap overwrite primitive.\nA:H - The maintainer reports these crafted images \"cause system crashes\"; dereferencing and refcounting a garbage `struct page *` from the out-of-bounds bvec, plus slab corruption from the out-of-bounds store, reliably produce oopses, KASAN splats, and panics."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/erofs/zmap.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "1d191b4ca51d73699cb127386b95ac152af2b930",
|
|
"lessThan": "00d8fe0b72f4ca0a983abced36aad2160038c421",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "1d191b4ca51d73699cb127386b95ac152af2b930",
|
|
"lessThan": "a429b76114aaca3ef1aff4cd469dcf025431bd11",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/erofs/zmap.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6.15",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "6.15",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.17.6",
|
|
"lessThanOrEqual": "6.17.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.15",
|
|
"versionEndExcluding": "6.17.6"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.15",
|
|
"versionEndExcluding": "6.18"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/00d8fe0b72f4ca0a983abced36aad2160038c421"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/a429b76114aaca3ef1aff4cd469dcf025431bd11"
|
|
}
|
|
],
|
|
"title": "erofs: fix crafted invalid cases for encoded extents",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |