In the Linux kernel, the following vulnerability has been resolved:
isofs: fix out-of-bounds page array access on empty zisofs block
zisofs_uncompress_block()'s empty-block fast path returns
pcount << PAGE_SHIFT, ignoring the incoming poffset, unlike the
decompression path which returns bytes produced relative to poffset.
zisofs_fill_pages() uses that return to advance its page cursor, so when
the zisofs block size is below PAGE_SIZE and a sub-page block leaves
poffset partway into a page, a following empty block over-counts and
advances pages[] one element past its end, after which
"if (poffset && *pages)" reads pages[1] out of bounds. rock.c only
rejects a block-size shift > 17, so a crafted "ZF" Rock Ridge record can
set it below PAGE_SHIFT; the bug is reached by an ordinary read() of a
compressed file on such a mounted ISO9660 image.
Return the byte count relative to poffset and zero only
[poffset, PAGE_SIZE) of the first page, matching the decompression path.
The page-aligned case (poffset == 0) is unaffected.
BUG: KASAN: slab-out-of-bounds in zisofs_read_folio (fs/isofs/compress.c:290)
Read of size 8 at addr ffff88800f5eac48 by task exploit/142
zisofs_read_folio (fs/isofs/compress.c:290)
read_pages (mm/readahead.c:184)
...
filemap_read (mm/filemap.c:2814)
vfs_read (fs/read_write.c:574)
__x64_sys_pread64 (fs/read_write.c:769)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
The buggy address is located 0 bytes to the right of the
allocated 8-byte region in the kmalloc-8 cache
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - isofs assigns s_export_op to isofs_export_ops; nfsd_read then nfsd_iter_read (vfs_iocb_iter_read) and ksmbd_vfs_read (kernel_read) perform VFS reads that reach generic_file_read_iter, filemap_read, and zisofs_read_folio, so a remote NFS or SMB client can trigger the bug on a host exporting a crafted ISO9660 image.
AC:L - The attacker fully controls the Rock Ridge ZF parms (rock.c only rejects block_shift > 17) and the zisofs block pointer table; a block_shift below PAGE_SHIFT plus a nonempty sub-page block followed by an empty block (block_start==block_end) deterministically over-advances pages[] with no race.
PR:N - A remote NFS or SMB client needs only read access to an exported iso9660 tree; AUTH_SYS media-server exports commonly require no host credentials, and compressed regular files default to S_IRUGO. No CAP_SYS_ADMIN on the victim host is required on the read path.
UI:N - Once an iso9660 volume containing the crafted zisofs file is exported, the NFS or SMB server processes the client's READ automatically; no separate victim must open a file or click a dialog at attack time beyond that pre-existing export.
S:U - The slab out-of-bounds pointer load and any memzero_page or SetPageUptodate side effects remain inside the host kernel; this is not a VM escape, IOMMU/DMA bypass, or other cross-authority boundary.
C:H - zisofs_fill_pages loads an 8-byte pointer from one slot past a kmalloc-8 pages[] allocation and may treat adjacent heap data as a struct page. With heap grooming this memory corruption can be turned into a kernel information-disclosure primitive, so confidentiality impact is High.
I:H - When the out-of-bounds pointer is non-NULL, memzero_page() writes zeros through kmap_local_page() of the forged page and SetPageUptodate() corrupts page flags, yielding a kernel write primitive against attacker-groomed heap or page objects that can be chained to control-flow hijack.
A:H - KASAN reports a slab-out-of-bounds read in zisofs_read_folio; feeding a non-page pointer to kmap_local_page or memzero_page oopses or panics the kernel, and the attacker can repeat the NFS, SMB, or local read at will.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - isofs assigns s_export_op to isofs_export_ops; nfsd_read then nfsd_iter_read (vfs_iocb_iter_read) and ksmbd_vfs_read (kernel_read) perform VFS reads that reach generic_file_read_iter, filemap_read, and zisofs_read_folio, so a remote NFS or SMB client can trigger the bug on a host exporting a crafted ISO9660 image.
AC:L - The attacker fully controls the Rock Ridge ZF parms (rock.c only rejects block_shift > 17) and the zisofs block pointer table; a block_shift below PAGE_SHIFT plus a nonempty sub-page block followed by an empty block (block_start==block_end) deterministically over-advances pages[] with no race.
PR:N - A remote NFS or SMB client needs only read access to an exported iso9660 tree; AUTH_SYS media-server exports commonly require no host credentials, and compressed regular files default to S_IRUGO. No CAP_SYS_ADMIN on the victim host is required on the read path.
UI:N - Once an iso9660 volume containing the crafted zisofs file is exported, the NFS or SMB server processes the client's READ automatically; no separate victim must open a file or click a dialog at attack time beyond that pre-existing export.
S:U - The slab out-of-bounds pointer load and any memzero_page or SetPageUptodate side effects remain inside the host kernel; this is not a VM escape, IOMMU/DMA bypass, or other cross-authority boundary.
C:H - zisofs_fill_pages loads an 8-byte pointer from one slot past a kmalloc-8 pages[] allocation and may treat adjacent heap data as a struct page. With heap grooming this memory corruption can be turned into a kernel information-disclosure primitive, so confidentiality impact is High.
I:H - When the out-of-bounds pointer is non-NULL, memzero_page() writes zeros through kmap_local_page() of the forged page and SetPageUptodate() corrupts page flags, yielding a kernel write primitive against attacker-groomed heap or page objects that can be chained to control-flow hijack.
A:H - KASAN reports a slab-out-of-bounds read in zisofs_read_folio; feeding a non-page pointer to kmap_local_page or memzero_page oopses or panics the kernel, and the attacker can repeat the NFS, SMB, or local read at will.
CVSS 3.1