Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-09-22 13:01:16 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(storage/fatfs): fix exFAT mount integer overflow (CVE-2026-6682)

Browse Source 
The exFAT mount path validates that the media is large enough to hold the
declared cluster heap with:

    if (maxlba < (QWORD)fs->database + ncl * fs->csize) ...

`ncl` (DWORD, up to MAX_EXFAT) and `fs->csize` (WORD) are both promoted to
`unsigned int`, so `ncl * fs->csize` is evaluated in 32-bit arithmetic and can
wrap before the QWORD promotion of the sum. A crafted image with a large
NumClusters/SecPerClus can therefore make an undersized volume pass the "size
is large enough" check; subsequent cluster->sector math then addresses media
outside the actual device.

Promote the multiply to 64-bit ((QWORD)ncl * fs->csize). Apply the same
promotion to the bitmap-base computation ((LBA_t)fs->csize * (bcl - 2)), which
has the identical overflow shape. Record the CVE in the component SBOM.

Reference: https://www.runzero.com/blog/fatfs-bugs/
This commit is contained in:
Tomáš Rohlínek
2026-07-06 13:37:28 +02:00
parent a1695a475b
commit 388efbf2b7
2 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
components/fatfs/sbom.yml
View File

@@ -3,3 +3,6 @@ version: 'R0.16'
supplier: 'Organization: Espressif Systems (Shanghai) CO LTD'
originator: 'Person: ChaN'
description: 'Generic FAT Filesystem Module for embedded systems.'
cve-exclude-list:
- cve: CVE-2026-6682
reason: Integer overflow in exFAT mount size validation. Patched by promoting the cluster-heap and bitmap-base multiplies to 64-bit in mount_volume().

4
components/fatfs/src/ff.c
View File

@@ -3560,7 +3560,7 @@ static FRESULT mount_volume ( /* FR_OK(0): successful, !=0: an error occurred */
fs->volbase = bsect;
fs->database = bsect + ld_32(fs->win + BPB_DataOfsEx);
fs->fatbase = bsect + ld_32(fs->win + BPB_FatOfsEx);
if (maxlba < (QWORD)fs->database + ncl * fs->csize) return FR_NO_FILESYSTEM; /* (Volume size must not be smaller than the size required) */
if (maxlba < (QWORD)fs->database + (QWORD)ncl * fs->csize) return FR_NO_FILESYSTEM; /* CVE-2026-6682: promote to 64-bit before multiply to avoid integer overflow that would accept an undersized volume */
fs->dirbase = ld_32(fs->win + BPB_RootClusEx);
/* Get bitmap location and check if it is contiguous (implementation assumption) */
@@ -3576,7 +3576,7 @@ static FRESULT mount_volume ( /* FR_OK(0): successful, !=0: an error occurred */
}
bcl = ld_32(fs->win + i + 20); /* Bitmap cluster */
if (bcl < 2 || bcl >= fs->n_fatent) return FR_NO_FILESYSTEM; /* (Wrong cluster#) */
fs->bitbase = fs->database + fs->csize * (bcl - 2); /* Bitmap sector */
fs->bitbase = fs->database + (LBA_t)fs->csize * (bcl - 2); /* Bitmap sector (CVE-2026-6682: 64-bit multiply to avoid overflow) */
for (;;) { /* Check if bitmap is contiguous */
if (move_window(fs, fs->fatbase + bcl / (SS(fs) / 4)) != FR_OK) return FR_DISK_ERR;
cv = ld_32(fs->win + bcl % (SS(fs) / 4) * 4);