Description

A stack out-of-bounds write vulnerability was found in gfs2-utils. In gfs2_edit, the di_height field from on-disk inode metadata is used as an array index without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.0",
  "pubDate": "2026-09-03T13:06:02.703Z",
  "pubdate": "2026-09-03T13:06:02.703Z",
  "executiveSummary": "A critical stack out-of-bounds write vulnerability exists within gfs2_edit, a component of gfs2-utils used for filesystem manipulation. The vulnerability arises from an improper validation of the di_height field retrieved from on-disk inode metadata.\nBy supplying a crafted GFS2 filesystem image containing an inode with a malicious di_height value, an attacker can trigger an out-of-bounds memory write on the stack. This memory corruption can lead to the overwriting of return addresses or critical function pointers, potentially resulting in arbitrary code execution with the privileges of the user running gfs2_edit.\nThis vulnerability is particularly dangerous because it requires no network exposure; the exploitation occurs locally when a user is induced to open or inspect a malicious filesystem image. Given that gfs2_edit is frequently used for administrative tasks, successful exploitation could lead to full system compromise or privilege escalation if the tool is executed with elevated permissions. The vulnerability highlights a lack of defensive bounds checking when processing untrusted, attacker-controlled on-disk structures.",
  "technicalDetails": "The vulnerability is located within the gfs2_edit utility, specifically in the logic responsible for parsing inode metadata from a GFS2 filesystem. The root cause is a classic lack of input validation regarding the 'di_height' field found in the inode structure.\nIn the GFS2 architecture, the di_height field is intended to represent the height of the indirect block pointer tree for an inode. The gfs2_edit utility uses this value as an index into a fixed-size stack-allocated array during its metadata processing routine. Because the application fails to verify that the di_height value falls within the legitimate range of the target array, an attacker can provide a metadata structure with an arbitrarily large di_height value.\nThe attack flow proceeds as follows: First, the attacker creates a malformed GFS2 filesystem image where an inode's di_height value exceeds the maximum capacity of the statically allocated buffer intended to store metadata references. Second, the attacker causes the victim to execute gfs2_edit on this malicious image (e.g., for investigation, repair, or debugging). Third, as the utility reads the inode and accesses the metadata array, the out-of-bounds index causes the application to write data beyond the intended stack boundary.\nBecause this write occurs on the stack, the attacker can precisely control the data being written to manipulate the execution flow of the process. By carefully crafting the metadata structure, an attacker can overwrite the saved instruction pointer (return address) or other sensitive stack-resident structures. Upon the conclusion of the vulnerable function, the processor will jump to the address dictated by the corrupted stack data, enabling arbitrary code execution.\nThis vulnerability is classified as a memory corruption flaw, specifically a stack-based buffer overflow. As the tool does not strictly require authentication to process a file—provided the user has the necessary read permissions to open the device or image—the exploitation is dependent on the victim's interaction with the malicious file. The lack of stack canaries or improper compiler hardening could facilitate easier exploitation, turning this metadata processing error into a high-severity security incident. The post-exploitation impact includes the execution of arbitrary payloads, potential container escapes if the tool is used within an isolated environment, and broad unauthorized control over the local system environment."
}