CVE-2023-52933: Vulnerability in Linux Linux

Severity: mediumType: vulnerabilityCVE-2023-52933

In the Linux kernel, the following vulnerability has been resolved: Squashfs: fix handling and sanity checking of xattr_ids count A Sysbot [1] corrupted filesystem exposes two flaws in the handling and sanity checking of the xattr_ids count in the filesystem. Both of these flaws cause computation overflow due to incorrect typing. In the corrupted filesystem the xattr_ids value is 4294967071, which stored in a signed variable becomes the negative number -225. Flaw 1 (64-bit systems only): The signed integer xattr_ids variable causes sign extension. This causes variable overflow in the SQUASHFS_XATTR_*(A) macros. The variable is first multiplied by sizeof(struct squashfs_xattr_id) where the type of the sizeof operator is "unsigned long". On a 64-bit system this is 64-bits in size, and causes the negative number to be sign extended and widened to 64-bits and then become unsigned. This produces the very large number 18446744073709548016 or 2^64 - 3600. This number when rounded up by SQUASHFS_METADATA_SIZE - 1 (8191 bytes) and divided by SQUASHFS_METADATA_SIZE overflows and produces a length of 0 (stored in len). Flaw 2 (32-bit systems only): On a 32-bit system the integer variable is not widened by the unsigned long type of the sizeof operator (32-bits), and the signedness of the variable has no effect due it always being treated as unsigned. The above corrupted xattr_ids value of 4294967071, when multiplied overflows and produces the number 4294963696 or 2^32 - 3400. This number when rounded up by SQUASHFS_METADATA_SIZE - 1 (8191 bytes) and divided by SQUASHFS_METADATA_SIZE overflows again and produces a length of 0. The effect of the 0 length computation: In conjunction with the corrupted xattr_ids field, the filesystem also has a corrupted xattr_table_start value, where it matches the end of filesystem value of 850. This causes the following sanity check code to fail because the incorrectly computed len of 0 matches the incorrect size of the table reported by the superblock (0 bytes). len = SQUASHFS_XATTR_BLOCK_BYTES(*xattr_ids); indexes = SQUASHFS_XATTR_BLOCKS(*xattr_ids); /* * The computed size of the index table (len bytes) should exactly * match the table start and end points */ start = table_start + sizeof(*id_table); end = msblk->bytes_used; if (len != (end - start)) return ERR_PTR(-EINVAL); Changing the xattr_ids variable to be "usigned int" fixes the flaw on a 64-bit system. This relies on the fact the computation is widened by the unsigned long type of the sizeof operator. Casting the variable to u64 in the above macro fixes this flaw on a 32-bit system. It also means 64-bit systems do not implicitly rely on the type of the sizeof operator to widen the computation. [1] https://lore.kernel.org/lkml/000000000000cd44f005f1a0f17f@google.com/

AI Analysis

Technical Summary

CVE-2023-52933 is a vulnerability in the Linux kernel's handling of the Squashfs filesystem, specifically related to the processing and sanity checking of the xattr_ids count. Squashfs is a compressed read-only filesystem commonly used in embedded systems, live Linux distributions, and container environments. The vulnerability arises from incorrect typing and handling of the xattr_ids variable, which is used to count extended attribute IDs in the filesystem metadata. When a corrupted filesystem is presented with an xattr_ids value of 4294967071, this large unsigned integer is incorrectly interpreted as a signed integer, leading to negative values and subsequent integer overflows during arithmetic operations. On 64-bit systems, the signed integer is sign-extended and widened to 64 bits, resulting in an extremely large unsigned value (2^64 - 3600). On 32-bit systems, the multiplication overflows but still results in an incorrect length of zero. This incorrect length calculation causes the sanity check comparing the computed size of the xattr_id table to the filesystem's metadata boundaries to fail, potentially causing the kernel to reject the filesystem or behave unexpectedly. The root cause is the use of a signed integer type for xattr_ids, which should be unsigned to prevent sign extension and overflow issues. The fix involves changing the variable to an unsigned int on 64-bit systems and casting it to a 64-bit unsigned integer on 32-bit systems to ensure correct arithmetic. Although the vulnerability does not appear to have known exploits in the wild, it can cause denial of service conditions by preventing proper mounting or reading of Squashfs filesystems with corrupted metadata. This vulnerability affects multiple Linux kernel versions as indicated by the affected commit hashes and is relevant to any system using Squashfs, including embedded devices, containers, and live distributions.

Potential Impact

For European organizations, the impact of CVE-2023-52933 primarily involves potential denial of service (DoS) scenarios where systems using Squashfs filesystems may fail to mount or read corrupted filesystems due to the flawed sanity checks. This can affect embedded devices, network appliances, containerized applications, and live Linux environments that rely on Squashfs for compressed filesystem images. Critical infrastructure operators, telecommunications providers, and industrial control systems in Europe often use embedded Linux devices that may incorporate Squashfs, making them susceptible to operational disruptions if corrupted filesystems are encountered. Additionally, cloud service providers and enterprises using container technologies with Squashfs-based images could experience service interruptions or degraded availability. While this vulnerability does not directly lead to privilege escalation or remote code execution, the denial of service impact can disrupt business operations, especially in sectors relying on high availability and stability. The lack of known exploits reduces immediate risk, but the vulnerability should be addressed promptly to prevent exploitation in targeted attacks or accidental outages caused by corrupted filesystem images.

Mitigation Recommendations

European organizations should implement the following specific mitigation steps: 1) Apply the official Linux kernel patches that correct the xattr_ids variable typing and arithmetic handling as soon as they become available for their kernel versions. 2) For embedded and IoT devices, ensure firmware updates include the patched kernel to prevent exploitation in field devices. 3) Validate and verify the integrity of Squashfs filesystem images before deployment or use, employing cryptographic signatures or checksums to detect corruption or tampering. 4) Implement monitoring and alerting for filesystem mount failures or unusual kernel error messages related to Squashfs to detect potential exploitation attempts or corrupted images. 5) In containerized environments, rebuild container images with patched kernel versions and verify image integrity to avoid propagation of corrupted filesystems. 6) For critical systems, consider fallback mechanisms or redundancy to maintain availability if Squashfs mount failures occur. 7) Educate system administrators and security teams about this vulnerability to ensure timely patch management and incident response readiness. These measures go beyond generic advice by focusing on integrity verification, monitoring, and operational continuity specific to Squashfs usage.