CVE-2024-26982

What it actually does

Out-of-bounds memory access in Squashfs fill_meta_index() triggered when an inode with invalid number zero is created and later reused after a prior metadata read failure invalidates an empty index entry.

Why it matters to the business

Linux systems using Squashfs filesystems face risk of kernel crashes, memory corruption, or denial of service, potentially impacting server stability and requiring urgent patching across large fleets of affected devices.

How an attack unfolds

An attacker supplies a crafted Squashfs image containing an inode numbered zero. During read operations fill_meta_index() encounters a data error, aborts and marks the index with inode zero. Subsequent calls to locate_meta_index() match the zero inode and return the unfilled index, resulting in out-of-bounds access.

How to fix it

Apply kernel patch adding inode number sanity check that returns -EINVAL on zero during inode creation. Update to fixed versions containing commit 6679ad998df1d6d9714bcb3cc32a0e6dfcbe24de where applicable.

How to confirm the fix worked

Confirm presence of inode number != 0 check in Squashfs inode creation code and test with crafted images containing zero inode numbers to ensure -EINVAL is returned.

Typical attack path

1. Supply malicious Squashfs filesystem image with inode number zero
2. Mount or access the filesystem to trigger metadata reads
3. Induce data read error in fill_meta_index causing index invalidation with inode zero
4. Trigger follow-on read that reuses the invalid index entry
5. Perform out-of-bounds memory access leading to crash or corruption

How to detect it

Review kernel logs and dmesg for Squashfs-related out-of-bounds accesses or inode zero errors; inspect system calls involving mount and read on Squashfs images for anomalous behavior.

What your security team should do

• Prioritize kernel updates on all systems using Squashfs
• Audit environments for Squashfs filesystem usage and limit untrusted images
• Monitor kernel logs for related oops or panic entries
• Apply patches within standard maintenance windows given low EPSS and no KEV listing