statfs/statvfs accounting overflow and unvalidated compat feature bits (has_journal RW without replay)
| Field | Value |
|---|---|
| ID | DF-3051 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| CWE | CWE-190 / CWE-20 |
| File | sys/vfs/ext2fs/ext2_vfsops.c |
| Lines | 296-333, 1103-1129 |
| Area | vfs/ext2fs |
| Confidence | certain |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:vfs |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
(a) ext2_statfs/ext2_statvfs compute overhead in uint32_t: gcount*overhead_per_group (itpg up to 32768 with isize==bsize) wraps; f_bavail = f_bfree − rbcount underflows when rbcount>fbcount (both only bounded by <=bcount); f_blocks can go negative — userland-visible accounting lies from crafted sb fields, no kernel memory impact. (b) ext2_check_sb_compat validates only incompat and ro_compat masks; compat bits are never checked, so EXT2F_COMPAT_HASJOURNAL images (ext3) mount read-write with no journal replay — silent on-disk corruption of legitimately dirty ext3 filesystems (Linux requires replay or norecovery). Not PoC-verified (Info). Fix: uint64 arithmetic with clamping; mask compat features and force read-only (or reject) has_journal filesystems that were not cleanly unmounted.
Timeline
- 2026-09-02 Discovered during pass-2 audit of ext2_vfsops.c (GLM 5.3).
No comments yet.