Squashfs: sanity check symbolic link size

CVE-2024-46744

What is CVE-2024-46744?

A vulnerability in the Linux kernel's Squashfs has been identified related to inadequate validation of symbolic link sizes during disk operations. Specifically, an improperly initialized page can occur when a corrupted symbolic link size is read from disk, leading to erroneous behavior in subsequent operations. This is initiated when the function squashfs_read_inode() assigns an incorrect size to the inode, which, due to integer overflow, results in the length variable being negative. This condition leads to a loop responsible for filling page content being bypassed, ultimately leading to uninitialized memory exposure. A recent patch addresses this issue by including a sanity check to ensure that symbolic link sizes do not exceed anticipated limits.

References