Description

A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca() with an exponentially-derived size from the untrusted on-disk di_depth field without bounds validation. A crafted GFS2 filesystem image with a large di_depth value causes stack exhaustion and a denial of service when processed by fsck.gfs2, gfs2_edit, or savemeta.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-09-03T13:06:02.550Z",
  "pubdate": "2026-09-03T13:06:02.550Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability exists within the gfs2-utils suite, specifically impacting utilities that process GFS2 filesystem metadata.\nThe flaw originates from the improper handling of the on-disk di_depth field during hash table traversal in metawalk.c. By failing to validate the input size before allocating memory on the stack, the application is susceptible to stack exhaustion.\nAn unauthenticated attacker can exploit this vulnerability by providing a maliciously crafted GFS2 filesystem image. When this image is processed by fsck.gfs2, gfs2_edit, or savemeta, the resulting stack overflow leads to a Denial of Service (DoS) through application termination or system instability.\nThis vulnerability poses a significant risk to system integrity and availability, particularly for administrators performing maintenance on untrusted or compromised storage media. Successful exploitation does not require prior authentication, relying solely on the victim executing forensic or repair utilities against a malicious image.",
  "technicalDetails": "The vulnerability resides in the metawalk.c component of gfs2-utils. The root cause is the unsafe use of the alloca() function to allocate stack memory based on the di_depth field retrieved directly from the GFS2 filesystem metadata. The di_depth value is used to calculate the size of a hash table during metadata traversal.\nThe application calculates the allocation size using an exponential derivation applied to the di_depth field. Crucially, the code lacks boundary checks or sanity validation to ensure that the resulting value remains within the physical limits of the stack. Because alloca() allocates memory by adjusting the stack pointer, an excessively large value derived from the di_depth field causes the stack pointer to move beyond the allocated stack boundaries.\nThe attack flow begins when an attacker distributes a crafted GFS2 filesystem image. The target utilities (fsck.gfs2, gfs2_edit, or savemeta) are designed to traverse the metadata structure of the filesystem to perform integrity checks or data extraction. Upon encountering the malicious di_depth value, the program reaches the vulnerable code path in metawalk.c.\nThe call to alloca() triggers a stack overflow as the requested allocation size exceeds the remaining stack depth. This immediately results in a segmentation fault or a memory access violation, forcing the utility to crash. In the context of fsck.gfs2, a crash during a repair operation can leave a filesystem in an inconsistent or unrecoverable state, exacerbating the impact of the initial DoS.\nThere are no authentication or privilege requirements to trigger this vulnerability, as the utilities function by operating on filesystem images that may originate from external or untrusted sources. The vulnerability is restricted to the execution environment of the gfs2-utils; it does not require network exposure to exploit, as the attack is payload-driven via local file access or forensic analysis workflows. The post-exploitation impact is primarily limited to process-level Denial of Service, although the disruption of filesystem repair workflows provides a mechanism for significant operational impact."
}