Description

A heap out-of-bounds read vulnerability was found in gfs2-utils. The ea_num_ptrs field from on-disk extended attribute metadata is consumed without bounds validation, causing a heap buffer over-read that may disclose sensitive memory contents or cause a crash when processing crafted GFS2 filesystem images.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-03T13:06:03.050Z",
  "pubdate": "2026-09-03T13:06:03.050Z",
  "executiveSummary": "A heap out-of-bounds read vulnerability has been identified within gfs2-utils, stemming from insufficient validation of the ea_num_ptrs field during the processing of on-disk extended attribute metadata. This flaw affects the GFS2 filesystem utility suite and allows a local attacker to potentially compromise the integrity of the memory space or cause a denial-of-service condition.\nThe vulnerability resides in the way the software parses filesystem metadata structures. By providing a crafted GFS2 filesystem image containing an oversized or malicious ea_num_ptrs value, an attacker can trigger an out-of-bounds memory read. This exposure may result in the leakage of sensitive information stored in the heap memory of the affected process, or trigger a segmentation fault leading to an application crash.\nExploitation requires the victim to process a malicious or corrupted filesystem image. Given that gfs2-utils are typically invoked by administrative users or automated maintenance scripts, this could result in unauthorized data exposure if the process memory contains sensitive credentials or metadata. The risk level is categorized as moderate, primarily dependent on the ability of an attacker to introduce a malicious image into an environment where it will be processed by gfs2-utils.",
  "technicalDetails": "The root cause of this vulnerability is an input validation failure within the gfs2-utils codebase when handling extended attribute (EA) structures. Specifically, the ea_num_ptrs field, which defines the number of pointers associated with extended attribute data blocks, is consumed from on-disk metadata without proper boundary verification against the allocated heap buffer size.\nWhen processing a GFS2 image, the utility allocates a heap buffer intended to store metadata pointers. If the on-disk ea_num_ptrs value is manipulated to exceed the actual capacity of the allocated buffer, subsequent processing logic will continue to read beyond the intended buffer bounds. This heap out-of-bounds read allows the utility to access memory addresses outside the scope of the original object, essentially reading adjacent data present in the heap.\nThe exploitation flow begins with the creation of a malformed GFS2 filesystem image. An attacker embeds a specific, out-of-range value into the ea_num_ptrs field within the filesystem metadata. When a user runs gfs2-utils (such as fsck.gfs2 or related utilities) against this image, the utility reads the malicious metadata into memory. The parsing logic subsequently uses the attacker-controlled ea_num_ptrs value as an index or size limit for pointer operations. Because the program lacks a check to verify that ea_num_ptrs corresponds to the allocated memory buffer, the pointer iteration proceeds past the buffer's boundary.\nThe impact of this behavior is twofold. First, it facilitates information disclosure; the contents of adjacent heap memory—which may include pointers, cached data, or sensitive structures—are inadvertently processed or potentially exposed if the utility outputs or logs the retrieved attribute data. Second, it causes an application-level denial-of-service, as an out-of-bounds access attempt often results in a memory access violation (SIGSEGV), leading to the immediate termination of the process.\nSince gfs2-utils typically run with elevated privileges to manipulate filesystems, an attacker could potentially gain insight into memory structures or crash critical system maintenance tools. The vulnerability does not require authentication or network access to the GFS2 volume itself, but rather the ability to influence which filesystem images are processed by the tool. The absence of bounds checking on filesystem-derived metadata in C-based utilities remains a classic vector for memory corruption, requiring robust validation of all on-disk structures before they are treated as trusted input for memory allocation or iteration logic."
}