In the Linux kernel, the following vulnerability has been resolved:
ext4: fix out-of-bounds read in ext4_read_inline_dir()
ext4_read_inline_dir() can read a dirent header past the end of its inline
buffer, triggering a slab-out-of-bounds read during getdents64():
BUG: KASAN: slab-out-of-bounds in __ext4_check_dir_entry
Read of size 2 at addr ffff88800f3dd23c by task exploit/148
...
__ext4_check_dir_entry
ext4_read_inline_dir
iterate_dir
The dirent payload lives in a buffer of exactly inline_size bytes:
<pre>
dir_buf = kmalloc(inline_size, GFP_NOFS);
</pre>
but iteration runs in a position space extra_offset bytes larger
(extra_size = extra_offset + inline_size) so the synthetic "." and ".."
land at their block-dir offsets. A dirent is formed at "dir_buf + pos -
extra_offset", yet the ext4_check_dir_entry() length argument uses the
larger extra_size. A position whose dirent header would extend past
extra_size is therefore accepted, and the rescan loop's rec_len probe and
ext4_check_dir_entry() dereference de->rec_len before the entry is rejected.
Reject a position whose minimum-size dirent header would not fit within
extra_size before forming de, in both the rescan and main loops, and pass
inline_size rather than extra_size to ext4_check_dir_entry() so the length
check matches the physical buffer.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS Score: 9.1
AV:N - The slab OOB is in ext4_read_inline_dir(), reached from getdents64 via iterate_dir→ext4_readdir. nfsd_readdir does vfs_llseek plus iterate_dir, and ksmbd QUERY_DIRECTORY also calls iterate_dir, so a remote NFS/SMB client can trigger the same path on an ext4-backed export.
AC:L - A crafted inline directory with attacker-controlled rec_len values (or a seek/NFS cookie that lands ctx->pos near extra_size) deterministically forms a dirent past kmalloc(inline_size) and dereferences de->rec_len. No race or attacker-uncontrollable heap layout is required.
PR:N - READDIR on a guest/anonymous ksmbd share or AUTH_SYS NFS export needs no host account or capability. Automount of a malicious volume by udisks2/systemd also requires no attacker privileges on the victim.
UI:N - Once the crafted or inline-data ext4 volume is exported or automounted, the attacker alone issues NFS/SMB READDIR or local getdents64. No separate victim must open a file or confirm a dialog at attack time.
S:U - The out-of-bounds read and any resulting kernel crash stay within the host kernel's security authority. This is not a VM escape, IOMMU/DMA bypass, or other cross-boundary breakout.
C:H - ext4_check_dir_entry over-reads de->rec_len and adjacent dirent fields past the inline kmalloc buffer. If the inflated extra_size bound lets the check pass, dir_emit copies de->name for up to 255 bytes of adjacent kernel heap into the getdents/NFS/SMB reply.
I:N - The defect is an over-read on the readdir path only. ext4_read_inline_dir does not write the over-read dirent, and there is no out-of-bounds write, type confusion, or control-flow hijack primitive.
A:H - KASAN reports a slab-out-of-bounds read in __ext4_check_dir_entry. An over-read that reaches unmapped slab or guard pages oopses or panics the kernel, and the attacker can repeat READDIR/getdents against the crafted directory.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
None |
| User Interaction |
None |
Availability Impact |
High |
AV:N - The slab OOB is in ext4_read_inline_dir(), reached from getdents64 via iterate_dir→ext4_readdir. nfsd_readdir does vfs_llseek plus iterate_dir, and ksmbd QUERY_DIRECTORY also calls iterate_dir, so a remote NFS/SMB client can trigger the same path on an ext4-backed export.
AC:L - A crafted inline directory with attacker-controlled rec_len values (or a seek/NFS cookie that lands ctx->pos near extra_size) deterministically forms a dirent past kmalloc(inline_size) and dereferences de->rec_len. No race or attacker-uncontrollable heap layout is required.
PR:N - READDIR on a guest/anonymous ksmbd share or AUTH_SYS NFS export needs no host account or capability. Automount of a malicious volume by udisks2/systemd also requires no attacker privileges on the victim.
UI:N - Once the crafted or inline-data ext4 volume is exported or automounted, the attacker alone issues NFS/SMB READDIR or local getdents64. No separate victim must open a file or confirm a dialog at attack time.
S:U - The out-of-bounds read and any resulting kernel crash stay within the host kernel's security authority. This is not a VM escape, IOMMU/DMA bypass, or other cross-boundary breakout.
C:H - ext4_check_dir_entry over-reads de->rec_len and adjacent dirent fields past the inline kmalloc buffer. If the inflated extra_size bound lets the check pass, dir_emit copies de->name for up to 255 bytes of adjacent kernel heap into the getdents/NFS/SMB reply.
I:N - The defect is an over-read on the readdir path only. ext4_read_inline_dir does not write the over-read dirent, and there is no out-of-bounds write, type confusion, or control-flow hijack primitive.
A:H - KASAN reports a slab-out-of-bounds read in __ext4_check_dir_entry. An over-read that reaches unmapped slab or guard pages oopses or panics the kernel, and the attacker can repeat READDIR/getdents against the crafted directory.
CVSS 3.1