The Zephyr ext2 filesystem driver (subsys/fs/ext2) improperly trusts the on-disk directory entry fields de_rec_len and de_name_len when traversing directory blocks. The function ext2_fetch_direntry() only checks if de_name_len is greater than EXT2_MAX_FILE_NAME (255), but since de_name_len is a uint8_t, this check is always false. Consequently, the code copies up to 255 bytes for the name without proper bounds checking and advances traversal by an unvalidated de_rec_len. This can cause reads and writes beyond the allocated block buffer, leaking adjacent kernel heap memory on directory reads and causing infinite loops or out-of-bounds memory operations on other paths. The vulnerability is reachable by any path-based operation on a mounted ext2 volume with a crafted or corrupted image. The affected versions are from Zephyr ext2 introduction in v3.5.0 through v4.4.0. The fix involves validating rec_len and name_len to reject malformed entries that cross block boundaries.

An attacker supplying a crafted or corrupted ext2 filesystem image can cause out-of-bounds reads that leak kernel heap memory, leading to information disclosure. Additionally, a zero de_rec_len value can cause an infinite loop, resulting in denial of service. Out-of-bounds writes can also occur, potentially destabilizing the system. The vulnerability affects all path-based operations on the ext2 filesystem, including open, stat, unlink, rename, mkdir, and directory listing.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has described a fix that validates rec_len and name_len fields to reject malformed directory entries, but no official patch or update link is provided in the current data. Until a patch is available, avoid mounting untrusted ext2 filesystem images in affected Zephyr versions.