Bug 2527992

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in gfs2-utils. In the gfs2_edit tool, the metapath_to_lblock() function in extended.c uses the di_height field from on-disk inode metadata as an array index into a fixed-size stack array factor[GFS2_MAX_META_HEIGHT] (10 elements) without bounds validation. An attacker can craft a GFS2 filesystem image with di_height exceeding 10 (up to 65535) to write past the end of the array, corrupting adjacent stack memory including saved registers and the return address. The subsequent loop (factor[h] = factor[h+1] * sbd.sd_inptrs) amplifies the corruption by writing additional entries past the array boundary. This is a classic stack buffer overflow that may allow arbitrary code execution when gfs2_edit processes the crafted image. The Linux kernel GFS2 driver validates di_height against sd_max_height in gfs2_dinode_in(), but the userspace gfs2-utils performs no equivalent validation.