CVE-2023-52933

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Squashfs: fix handling and sanity checking of xattr_ids count

A Sysbot [1] corrupted filesystem exposes two flaws in the handling and

sanity checking of the xattr_ids count in the filesystem. Both of these

flaws cause computation overflow due to incorrect typing.

In the corrupted filesystem the xattr_ids value is 4294967071, which

stored in a signed variable becomes the negative number -225.

Flaw 1 (64-bit systems only):

The signed integer xattr_ids variable causes sign extension.

This causes variable overflow in the SQUASHFS_XATTR_*(A) macros. The

variable is first multiplied by sizeof(struct squashfs_xattr_id) where the

type of the sizeof operator is "unsigned long".

On a 64-bit system this is 64-bits in size, and causes the negative number

to be sign extended and widened to 64-bits and then become unsigned. This

produces the very large number 18446744073709548016 or 2^64 - 3600. This

number when rounded u

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References