Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-09-22 13:01:16 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(storage/fatfs): reject empty exFAT cluster heap and guard divisor (CVE-2026-6683)

Browse Source 
The FAT12/16/32 mount path rejects a zero cluster count, but the exFAT path
accepted NumClusters == 0. That yields fs->n_fatent == 2, and sync_fs() later
computes the "percent in use" field as:

    ... * 100 / (fs->n_fatent - 2)

which is a division by zero (n_fatent - 2 == 0) -> crash. On a device that
syncs during an update this can brick the unit.

Reject ncl == 0 at exFAT mount time, and add a defense-in-depth
`fs->n_fatent > 2` guard around the division in sync_fs() so the divisor can
never be zero even if some future path produces such a filesystem object.
Record the CVE in the component SBOM.

Reference: https://www.runzero.com/blog/fatfs-bugs/
This commit is contained in:
Tomáš Rohlínek
2026-07-06 13:37:59 +02:00
parent 388efbf2b7
commit 895de2abee
2 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
components/fatfs/sbom.yml
View File

@@ -6,3 +6,5 @@ description: 'Generic FAT Filesystem Module for embedded systems.'
cve-exclude-list:
- cve: CVE-2026-6682
reason: Integer overflow in exFAT mount size validation. Patched by promoting the cluster-heap and bitmap-base multiplies to 64-bit in mount_volume().
- cve: CVE-2026-6683
reason: exFAT divide-by-zero when NumClusters == 0. Patched by rejecting an empty cluster heap at mount and guarding the divisor (n_fatent > 2) in sync_fs().

3
components/fatfs/src/ff.c
View File

@@ -1133,7 +1133,7 @@ static FRESULT sync_fs ( /* Returns FR_OK or FR_DISK_ERR */
#if FF_FS_EXFAT
else if (fs->fs_type == FS_EXFAT) { /* exFAT: Update PercInUse field in BPB */
if (disk_read(fs->pdrv, fs->win, fs->winsect = fs->volbase, 1) == RES_OK) { /* Load VBR */
BYTE perc_inuse = (fs->free_clst <= fs->n_fatent - 2) ? (BYTE)((QWORD)(fs->n_fatent - 2 - fs->free_clst) * 100 / (fs->n_fatent - 2)) : 0xFF; /* Precent in use 0-100 or 0xFF(unknown) */
BYTE perc_inuse = (fs->n_fatent > 2 && fs->free_clst <= fs->n_fatent - 2) ? (BYTE)((QWORD)(fs->n_fatent - 2 - fs->free_clst) * 100 / (fs->n_fatent - 2)) : 0xFF; /* Precent in use 0-100 or 0xFF(unknown). CVE-2026-6683: guard divisor (n_fatent-2) against zero */
if (fs->win[BPB_PercInUseEx] != perc_inuse) { /* Write it back into VBR if needed */
fs->win[BPB_PercInUseEx] = perc_inuse;
@@ -3554,6 +3554,7 @@ static FRESULT mount_volume ( /* FR_OK(0): successful, !=0: an error occurred */
ncl = ld_32(fs->win + BPB_NumClusEx); /* Number of clusters */
if (ncl > MAX_EXFAT) return FR_NO_FILESYSTEM; /* (Too many clusters) */
if (ncl == 0) return FR_NO_FILESYSTEM; /* CVE-2026-6683: reject empty cluster heap (n_fatent-2==0 causes divide-by-zero in sync_fs) */
fs->n_fatent = ncl + 2;
/* Boundaries and Limits */