In the Linux kernel, the following vulnerability has been resolved:
Squashfs: fix handling and sanity checking of xattr_ids count
A Sysbot [1] corrupted filesystem exposes two flaws in the handling and sanity checking of the xattr_ids count in the filesystem. Both of these flaws cause computation overflow due to incorrect typing.
In the corrupted filesystem the xattr_ids value is 4294967071, which stored in a signed variable becomes the negative number -225.
Flaw 1 (64-bit systems only):
The signed integer xattr_ids variable causes sign extension.
This causes variable overflow in the SQUASHFS_XATTR_*(A) macros. The variable is first multiplied by sizeof(struct squashfs_xattr_id) where the type of the sizeof operator is "unsigned long".
On a 64-bit system this is 64-bits in size, and causes the negative number to be sign extended and widened to 64-bits and then become unsigned. This produces the very large number 18446744073709548016 or 2^64 - 3600. This number when rounded up by SQUASHFS_METADATA_SIZE - 1 (8191 bytes) and divided by SQUASHFS_METADATA_SIZE overflows and produces a length of 0 (stored in len).
Flaw 2 (32-bit systems only):
On a 32-bit system the integer variable is not widened by the unsigned long type of the sizeof operator (32-bits), and the signedness of the variable has no effect due it always being treated as unsigned.
The above corrupted xattr_ids value of 4294967071, when multiplied overflows and produces the number 4294963696 or 2^32 - 3400. This number when rounded up by SQUASHFS_METADATA_SIZE - 1 (8191 bytes) and divided by SQUASHFS_METADATA_SIZE overflows again and produces a length of 0.
The effect of the 0 length computation:
In conjunction with the corrupted xattr_ids field, the filesystem also has a corrupted xattr_table_start value, where it matches the end of filesystem value of 850.
This causes the following sanity check code to fail because the incorrectly computed len of 0 matches the incorrect size of the table reported by the superblock (0 bytes).
len = SQUASHFS_XATTR_BLOCK_BYTES(*xattr_ids); indexes = SQUASHFS_XATTR_BLOCKS(*xattr_ids);
/* * The computed size of the index table (len bytes) should exactly * match the table start and end points */ start = table_start + sizeof(*id_table); end = msblk->bytes_used;
if (len != (end - start)) return ERR_PTR(-EINVAL);
Changing the xattr_ids variable to be "usigned int" fixes the flaw on a 64-bit system. This relies on the fact the computation is widened by the unsigned long type of the sizeof operator.
Casting the variable to u64 in the above macro fixes this flaw on a 32-bit system.
It also means 64-bit systems do not implicitly rely on the type of the sizeof operator to widen the computation.
[1] https://lore.kernel.org/lkml/[email protected]/
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-debug-devel-matchedUpgrade kernel-rt-64k-modules-extraUpgrade kernel-abi-stablelistsUpgrade kernel-devel-matchedUpgrade kernel-64k-debug-modules-extraUpgrade rvUpgrade kernel-rt-64kUpgrade kernel-rt-64k-modulesUpgrade kernel-64k-devel-matchedUpgrade kernel-64k-debug-coreUpgrade kernel-rt-64k-debugUpgrade kernelUpgrade kernel-rt-modules-coreUpgrade kernel-cross-headersUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-rtUpgrade perfUpgrade libperfUpgrade kernel-64kUpgrade kernel-zfcpdump-coreUpgrade kernel-tools-libs-develUpgrade kernel-64k-debugUpgrade python3-perfUpgrade kernel-rt-modules-extraUpgrade kernel-uki-virt-addonsUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-debug-coreUpgrade kernel-64k-modules-extraUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-modules-coreUpgrade kernel-docUpgrade kernel-zfcpdumpUpgrade kernel-64k-modulesUpgrade kernel-headersUpgrade kernel-tools-libsUpgrade kernel-debug-coreUpgrade kernel-debug-develUpgrade kernel-rt-coreUpgrade kernel-modulesUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-uki-virtUpgrade kernel-develUpgrade rtlaUpgrade kernel-modules-extraUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-64k-modules-coreUpgrade kernel-rt-debugUpgrade kernel-64k-modules-coreUpgrade kernel-debugUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-64k-coreUpgrade kernel-rt-modulesUpgrade kernel-uki-virtUpgrade kernel-coreUpgrade kernel-debug-modulesUpgrade kernel-64k-debug-develUpgrade kernel-modules-coreUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-rt-develUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-rt-kvmUpgrade kernel-64k-debug-modulesUpgrade kernel-64k-debug-modules-coreUpgrade kernel-64k-develUpgrade kernel-rt-64k-develUpgrade kernel-zfcpdump-devel | Jul 3, 2025 | Mar 27, 2025 |
| Amazon Linux Ami 2 | — | Upgrade bpftoolUpgrade kernel-livepatch-5.10.173-154.642Upgrade kernel-tools-develUpgrade kernelUpgrade kernel-develUpgrade kernel-livepatch-5.15.93-55.139Upgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-debuginfoUpgrade perfUpgrade kernel-livepatch-4.14.309-231.529Upgrade bpftool-debuginfoUpgrade kernel-toolsUpgrade kernel-headersUpgrade kernel-debuginfo-common-x86_64Upgrade perf-debuginfoUpgrade python-perfUpgrade python-perf-debuginfo | May 21, 2025 | Mar 27, 2025 |
| Amazon_linux_2023 | — | Upgrade kernel-debuginfoUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-toolsUpgrade kernel-tools-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-libbpfUpgrade kernel-headersUpgrade python3-perf-debuginfoUpgrade kernel-tools-develUpgrade kernel-libbpf-staticUpgrade perfUpgrade kernelUpgrade kernel-libbpf-develUpgrade kernel-livepatch-6.1.12-17.42Upgrade python3-perfUpgrade bpftoolUpgrade kernel-devel | Jun 11, 2025 | Mar 27, 2025 |
| Debian | — | Upgrade linux | Mar 31, 2025 | Mar 27, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade bpftoolUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade python3-perfUpgrade kernelUpgrade kernel-abi-stablelists | Jun 11, 2025 | Mar 27, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade bpftoolUpgrade kernel-tools-libsUpgrade kernelUpgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernel-tools | Jul 1, 2025 | Mar 27, 2025 |
| Oracle_linux | — | Upgrade kernel | Jul 2, 2025 | Mar 27, 2025 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Jul 1, 2025 | Mar 27, 2025 |
| Ubuntu | — | Upgrade linux-riscv-5.15Upgrade linux-oracle-5.4Upgrade linux-aws-hweUpgrade linux-aws-5.15Upgrade linux-lowlatency-hwe-5.15Upgrade linux-raspiUpgrade linux-aws-5.4Upgrade linux-lowlatencyUpgrade linux-realtimeUpgrade linux-ibm-5.4Upgrade linuxUpgrade linux-bluefieldUpgrade linux-awsUpgrade linux-raspi-5.4Upgrade linux-fipsUpgrade linux-gkeUpgrade linux-nvidia-tegra-5.15Upgrade linux-oracleUpgrade linux-hwe-5.15Upgrade linux-hweUpgrade linux-iotUpgrade linux-intel-iotg-5.15Upgrade linux-ibmUpgrade linux-azureUpgrade linux-azure-5.15Upgrade linux-xilinx-zynqmpUpgrade linux-azure-4.15Upgrade linux-hwe-5.4Upgrade linux-kvmUpgrade linux-gcpUpgrade linux-azure-5.4Upgrade linux-gcp-4.15Upgrade linux-gkeopUpgrade linux-oracle-5.15Upgrade linux-nvidiaUpgrade linux-aws-fipsUpgrade linux-azure-fipsUpgrade linux-gcp-5.15Upgrade linux-intel-iotgUpgrade linux-gcp-fipsUpgrade linux-gcp-5.4Upgrade linux-intel-iot-realtime | Apr 1, 2025 | Mar 27, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Mar 27, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub