linux-kernel - [DISCUSS] Security implications of slab-out-of-bounds Read issue in hfsplus

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CANypQFbLkw50aXkdjTbYT2S6me5yowReL2asG__MWveMU=vW0g@mail.gmail.com>
Date: Wed, 22 Oct 2025 10:44:45 +0800
From: Jiaming Zhang <r772577952@...il.com>
To: frank.li@...o.com, glaubitz@...sik.fu-berlin.de, 
	linux-fsdevel@...r.kernel.org, slava@...eyko.com
Cc: linux-kernel@...r.kernel.org, Jiaming Zhang <r772577952@...il.com>
Subject: [DISCUSS] Security implications of slab-out-of-bounds Read issue in hfsplus_strcasecmp

Hi HFS+ maintainers,

I am starting this thread to discuss the security implications of an
issue in the HFS+ filesystem and to seek your suggestions on whether
it should be assigned a CVE.  I discussed this with the CVE team
earlier, and they suggested I seek opinions from the filesystem
maintainers.

The issue is a slab-out-of-bounds read in hfsplus_strcasecmp(), fixed
by commit 42520df65bf6 ("hfsplus: fix slab-out-of-bounds read in
hfsplus_strcasecmp()"). The issue can be triggered by a corrupted
filesystem image. I also tried to use `fsck.hfsplus` to fix the image,
but the fix failed (exiting with code 8), meaning it would not be
auto-mounted.

This phenomenon means that the barrier to issue exploitation is
relatively high, but I believe the issue's impact still warrants a CVE
for the following reason: it involves kernel-level memory corruption.
If a privileged user attempts to mount a specially crafted HFS+ image
manually, this issue can be triggered, leading to a kernel panic and a
system crash.

A reliable, user-triggered kernel Denial of Service (DoS) is generally
considered a security issue worth tracking.

Given this, I would greatly appreciate your suggestions on whether a
CVE should be assigned to this issue. If you agree, I will follow up
with the CVE team to proceed with the assignment process.

Original issue report:
https://lore.kernel.org/all/CANypQFak7_YYBa_zpa8YmoYzekV_f39jvWJ-STudDUTR2-B_3Q@mail.gmail.com/

Thank you for your time and expertise.

Best regards,
Jiaming Zhang