mirror of
https://github.com/espressif/esp-idf.git
synced 2026-09-22 13:01:16 +03:00
0a223b51f8
The initial CVE-2026-6682 fix hardened the exFAT mount path, but the CVE as reported by runZero is a FAT32 defect in mount_volume() and is reachable in the default configuration (exFAT and 64-bit LBA disabled). This corrects the fix. Root cause: `fasize *= fs->n_fats` is a DWORD multiply with no overflow guard. A crafted BPB_FATSz32 such as 0x80000001 with NumFATs=2 wraps `fasize` to 0x00000002. The wrapped (too-small) FAT size places `fs->database` inside the FAT region, so a forged directory entry yields an attacker-controlled `finfo.fsize`; a caller using it as a read length overflows its buffer with attacker-controlled bytes (CVSS 7.6). Fix: reject per-FAT and reserved+FAT+root system-area sizes that overflow DWORD before they are used to derive the data-area base. The exFAT cluster-heap/bitmap 64-bit promotions are retained as defense-in-depth and relabeled (they are not CVE-2026-6682). SBOM reason updated.