Description

A stack overflow vulnerability was found in gfs2-utils. The metadata walk code in metawalk.c uses alloca() with an untrusted inode height value from on-disk metadata without bounds validation, causing stack exhaustion and a denial of service when processing crafted GFS2 filesystem images.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-09-03T13:06:03.233Z",
  "pubdate": "2026-09-03T13:06:03.233Z",
  "executiveSummary": "A stack overflow vulnerability exists within the gfs2-utils package, specifically affecting the metadata walk functionality. The flaw originates from the improper use of the alloca() function, which allocates memory on the stack based on an untrusted inode height value retrieved directly from on-disk GFS2 filesystem metadata.\nBy crafting a malicious GFS2 filesystem image with a manipulated inode height value, an attacker can trigger uncontrolled stack growth. This leads to stack exhaustion, causing the gfs2-utils processes—such as fsck.gfs2—to crash, resulting in a Denial of Service (DoS).\nThis vulnerability poses a significant risk to systems that process untrusted or externally sourced filesystem images. The exploitation requires the target to mount or inspect a malformed filesystem image containing the crafted metadata. There are no authentication requirements to trigger this vulnerability, as the crash occurs during the processing of the malicious disk structure. Successful exploitation typically results in immediate service termination or application-level failure, potentially leaving the filesystem in an inconsistent state or hindering system recovery efforts if the utility is used during boot-time filesystem checks.",
  "technicalDetails": "The vulnerability resides in metawalk.c within the gfs2-utils codebase. The affected component is responsible for traversing the GFS2 metadata tree, which defines the structural layout of files on the disk. During this traversal, the utility reads the inode height—a value indicating the depth of the block pointer tree—directly from the on-disk metadata structure.\nThe flaw manifests because the software invokes alloca() to allocate memory on the process stack using this untrusted inode height value as a multiplier or size factor without performing any bounds validation or sanity checks. The alloca() function dynamically allocates memory on the stack frame of the caller. Unlike heap-based allocations (such as malloc), stack memory is limited and managed by the operating system's process stack size constraints.\nWhen a malicious filesystem image provides an excessively large inode height, the call to alloca() attempts to reserve a memory block that exceeds the available stack space. This results in a stack overflow condition, which corrupts adjacent memory or triggers an immediate segmentation fault (SIGSEGV) due to the exhaustion of the process's allocated stack segment.\nThe attack flow proceeds as follows: 1) An attacker creates a malformed GFS2 filesystem image by modifying the inode metadata to include an abnormally high value for the tree height field. 2) The attacker lures a victim or a system service to process this image using gfs2-utils tools, such as fsck.gfs2. 3) The metadata walk logic in metawalk.c reads the malicious height value. 4) The program executes alloca() with the attacker-controlled input. 5) The stack pointer moves beyond the valid stack boundaries, leading to an immediate process crash and Denial of Service.\nThis vulnerability is particularly impactful because it affects the very tools designated for filesystem maintenance and repair. If an automated system or a system administrator runs fsck.gfs2 on a corrupted volume and the process crashes due to stack exhaustion, it may prevent the filesystem from being repaired or mounted, effectively locking the data. The vulnerability does not appear to require authentication, as the execution of the utility is the primary attack vector. Given the nature of filesystem utilities, these tools often operate with elevated privileges, potentially expanding the impact if a local attacker can force the execution of these utilities against malicious images."
}