EUVD-2026-37927
GHSA-f559-vgh2-9hj6
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector and required user interaction (run tool on crafted image); no privileges needed; crash-only impact with no confidentiality or integrity effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
NILFS utilities through 2.3.0, fixed in commit 26efb5d, nilfs_sb_is_valid() function fails to validate s_log_block_size field in NILFS2 superblock before bit-shift operations. Attackers supplying crafted NILFS2 images trigger undefined behavior through oversized shifts or out-of-memory conditions, crashing tools like nilfs-tune and dumpseg.
AnalysisAI
NILFS utilities (nilfs-utils) through version 2.3.0 crash when processing crafted NILFS2 filesystem images due to missing bounds validation on the s_log_block_size superblock field before performing bit-shift operations. Tools including nilfs-tune and dumpseg are affected: an attacker who can persuade a user to process a malicious image can trigger undefined behavior - either oversized shift operations or out-of-memory conditions - resulting in a denial of service via tool crash. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Technical ContextAI
NILFS2 is a log-structured filesystem for Linux. The nilfs-utils userspace toolkit provides administrative utilities (nilfs-tune, dumpseg, etc.) that parse the on-disk NILFS2 superblock structure (struct nilfs_super_block). The s_log_block_size field encodes the filesystem block size as a base-2 logarithm offset (block size = 1024 << s_log_block_size). The nilfs_sb_is_valid() function in lib/sb.c is responsible for superblock validation, but prior to commit 26efb5d it failed to check that s_log_block_size was within a valid range before it was used in downstream shift operations. An attacker-supplied value far exceeding the valid range (0-6, yielding 1 KiB-64 KiB block sizes) causes either a shift count that invokes undefined behavior under C standards or allocations sized orders of magnitude beyond available memory. CWE-1284 (Improper Validation of Specified Quantity in Input) precisely identifies the root cause: an integer quantity from external input is used in a sensitive operation (bit shift, memory allocation) without a preceding range check. Affected product confirmed by CPE cpe:2.3:a:nilfs-dev:nilfs-utils:*:*:*:*:*:*:*:*.
RemediationAI
Apply the upstream fix available at commit 26efb5daff0757365101035145331b0a5a85d9d9 (https://github.com/nilfs-dev/nilfs-utils/commit/26efb5daff0757365101035145331b0a5a85d9d9), which adds a one-line bounds check - rejecting any superblock where s_log_block_size exceeds 6 - to nilfs_sb_is_valid() in lib/sb.c. A patched tagged release version has not yet been confirmed from the available data; users should build nilfs-utils directly from the post-fix HEAD or monitor the upstream repository (https://github.com/nilfs-dev/nilfs-utils) for a release announcement. As a compensating control, restrict use of nilfs-tune and dumpseg to trusted NILFS2 images only, and avoid automating processing of externally-sourced or untrusted filesystem images until a patched release is available. Automated pipelines that ingest third-party NILFS2 images should be sandboxed (e.g., container or VM isolation) so a tool crash does not propagate to broader system availability.
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today