Description

A stack out-of-bounds write vulnerability was found in gfs2-utils. In savemeta, the height value from on-disk inode metadata is used as a loop bound without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.0",
  "pubDate": "2026-09-03T13:06:02.887Z",
  "pubdate": "2026-09-03T13:06:02.887Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability exists within the gfs2-utils package, specifically affecting the savemeta utility. The flaw arises from insufficient validation of metadata retrieved from GFS2 filesystem images. By providing a crafted image containing a malicious inode height value, an attacker can trigger an out-of-bounds write operation on the stack.\nThis vulnerability is categorized as a memory corruption issue that facilitates potential arbitrary code execution. Because savemeta is typically used for diagnostics and metadata extraction, the exploitation requires an attacker to convince a user or automated system to process a malicious, non-reputable GFS2 filesystem image. Successful exploitation allows the attacker to overwrite return addresses or sensitive control data on the stack, leading to execution of arbitrary code with the privileges of the process running the utility. The risk level is significant, as it transforms a passive data processing operation into a vector for system compromise through malicious input handling.",
  "technicalDetails": "The vulnerability is rooted in the savemeta utility within gfs2-utils. During the parsing of on-disk GFS2 inode metadata, the application reads the 'height' field from the inode structure. This value is subsequently utilized to define the bounds of a loop tasked with processing metadata blocks or pointers stored in internal data structures. The implementation fails to perform adequate bounds checking or sanity verification on this height value before using it as an iteration index or memory offset.\nWhen a filesystem image contains an abnormally high value for the inode metadata height, the application's logic proceeds to perform write operations based on this corrupted count. Because the destination buffer resides on the stack, the unchecked loop writes data beyond the intended allocated memory region. This causes a classic stack-based out-of-bounds write (buffer overflow), overwriting adjacent memory segments, which may include function pointers, local variables, or the saved instruction pointer (EIP/RIP).\nThe attack flow proceeds as follows: First, the attacker constructs a malicious GFS2 filesystem image where an inode's height metadata is explicitly set to an out-of-bounds value designed to exceed the size of the target stack buffer. Second, the attacker distributes this image to a target, potentially through shared storage or as a diagnostic artifact. Third, when a user executes the savemeta utility on this crafted image, the utility reads the malicious height metadata into memory. Fourth, the insecure loop iterates based on the attacker-supplied value, performing out-of-bounds writes into the stack memory segment. Finally, the attacker crafts the payload such that the overflow corrupts the return address, redirecting execution flow to attacker-controlled instructions or executing a ROP (Return Oriented Programming) chain embedded within the malformed filesystem metadata.\nThe vulnerable component is restricted to the metadata parsing logic in savemeta. Exploitation does not require network exposure in the traditional sense, as it is an offline, local, or remote-file-processing attack vector. Authentication and privilege requirements are dictated by the system's execution policy for savemeta; however, if the utility is executed by a high-privilege user or an automated management service, the potential for privilege escalation and full system compromise is severe."
}