gfs2-utils EUVD-2026-70449

Exploitation requires the victim user to actively run a gfs2-utils utility (specifically invoking the savemeta code path, e.g., gfs2_edit or a metadata inspection command) against a crafted GFS2 filesystem image controlled by the attacker. The attacker must pre-position a maliciously crafted image that the victim will process - no remote attack path exists. AC:H indicates that crafting a reliably exploitable payload requires overcoming stack layout uncertainty (ASLR, stack canaries). Exploitation is limited to: (1) environments where gfs2-utils is installed and used (RHEL HA/clustering deployments); (2) scenarios where an attacker can deliver a malicious image to a path the victim will process. Standard mitigations such as ASLR and stack canaries present barriers to reliable exploitation but are not guaranteed to prevent it given sufficient attacker control over the overflow data.

The CVSS 7.0 (AV:L/AC:H/PR:N/UI:R) vector accurately characterizes this as a constrained local-access vulnerability. The local attack vector (AV:L) means the attacker cannot exploit this over the network - delivery of a crafted image and user execution of gfs2-utils tools is required. High complexity (AC:H) reflects the need for a precisely crafted inode structure and the inherent unpredictability of stack layout exploitation. User interaction (UI:R) is a meaningful barrier: a victim must actively run gfs2-utils against the malicious image. Despite PR:N in the CVSS vector, real-world exploitation in cluster environments often involves administrators, who typically run gfs2-utils with elevated privileges, raising effective impact. No EPSS data, CISA KEV listing, or public POC was provided, and no active exploitation is indicated. Priority is low for most environments but elevated for organizations using GFS2 clustering in RHEL infrastructure where untrusted disk images could be introduced (e.g., forensics, migration, or shared storage scenarios).

An attacker crafts a GFS2 filesystem image containing an inode with an oversized height value designed to cause savemeta's loop to write past the end of a stack buffer. The attacker delivers this image through a shared storage volume, email attachment, or social engineering to an RHEL cluster administrator, who then runs a gfs2-utils diagnostic or metadata inspection command against it. The stack overflow overwrites the return address or stack canary, enabling arbitrary code execution at the privilege level of the gfs2-utils process (often root in cluster management contexts).