Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A vulnerability was found in the BusyBox romfs filesystem volume identification module (util-linux/volume_id/romfs.c). When parsing a romfs superblock, the code calls strlen() on attacker-controlled volume name metadata without any bounds checking. The resulting length is passed to memcpy() via volume_id_set_label_string(), which copies the data into a fixed-size label field of approximately 65 bytes.

A crafted romfs filesystem image can contain a volume name of up to approximately 4080 bytes. When such an image is processed by blkid or findfs, the unbounded memcpy() writes far beyond the label buffer boundary, corrupting adjacent heap memory.