[DISCUSS] Security implications of slab-out-of-bounds Read issue in hfsplus_strcasecmp

[Jiaming Zhang <r772577952@gmail.com>]

Hi HFS+ maintainers,

I am starting this thread to discuss the security implications of an
issue in the HFS+ filesystem and to seek your suggestions on whether
it should be assigned a CVE.  I discussed this with the CVE team
earlier, and they suggested I seek opinions from the filesystem
maintainers.

The issue is a slab-out-of-bounds read in hfsplus_strcasecmp(), fixed
by commit 42520df65bf6 ("hfsplus: fix slab-out-of-bounds read in
hfsplus_strcasecmp()"). The issue can be triggered by a corrupted
filesystem image. I also tried to use `fsck.hfsplus` to fix the image,
but the fix failed (exiting with code 8), meaning it would not be
auto-mounted.

This phenomenon means that the barrier to issue exploitation is
relatively high, but I believe the issue's impact still warrants a CVE
for the following reason: it involves kernel-level memory corruption.
If a privileged user attempts to mount a specially crafted HFS+ image
manually, this issue can be triggered, leading to a kernel panic and a
system crash.

A reliable, user-triggered kernel Denial of Service (DoS) is generally
considered a security issue worth tracking.

Given this, I would greatly appreciate your suggestions on whether a
CVE should be assigned to this issue. If you agree, I will follow up
with the CVE team to proceed with the assignment process.

Original issue report:
https://lore.kernel.org/all/CANypQFak7_YYBa_zpa8YmoYzekV_f39jvWJ-STudDUTR2-B_3Q@mail.gmail.com/

Thank you for your time and expertise.

Best regards,
Jiaming Zhang