In the Linux kernel, the following vulnerability has been resolved:
hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
The hfsplusreaddir() method is capable to crash by calling hfsplusuni2asc():
[ 667.121659][ T9805] ================================================================== [ 667.122651][ T9805] BUG: KASAN: slab-out-of-bounds in hfsplusuni2asc+0x902/0xa10 [ 667.123627][ T9805] Read of size 2 at addr ffff88802592f40c by task repro/9805 [ 667.124578][ T9805] [ 667.124876][ T9805] CPU: 3 UID: 0 PID: 9805 Comm: repro Not tainted 6.16.0-rc3 #1 PREEMPT(full) [ 667.124886][ T9805] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 667.124890][ T9805] Call Trace: [ 667.124893][ T9805] <TASK> [ 667.124896][ T9805] dumpstacklvl+0x10e/0x1f0 [ 667.124911][ T9805] printreport+0xd0/0x660 [ 667.124920][ T9805] ? virtaddrvalid+0x81/0x610 [ 667.124928][ T9805] ? _physaddr+0xe8/0x180 [ 667.124934][ T9805] ? hfsplusuni2asc+0x902/0xa10 [ 667.124942][ T9805] kasanreport+0xc6/0x100 [ 667.124950][ T9805] ? hfsplusuni2asc+0x902/0xa10 [ 667.124959][ T9805] hfsplusuni2asc+0x902/0xa10 [ 667.124966][ T9805] ? hfsplusbnoderead+0x14b/0x360 [ 667.124974][ T9805] hfsplusreaddir+0x845/0xfc0 [ 667.124984][ T9805] ? _pfxhfsplusreaddir+0x10/0x10 [ 667.124994][ T9805] ? stacktracesave+0x8e/0xc0 [ 667.125008][ T9805] ? iteratedir+0x18b/0xb20 [ 667.125015][ T9805] ? tracelockacquire+0x85/0xd0 [ 667.125022][ T9805] ? lockacquire+0x30/0x80 [ 667.125029][ T9805] ? iteratedir+0x18b/0xb20 [ 667.125037][ T9805] ? downreadkillable+0x1ed/0x4c0 [ 667.125044][ T9805] ? putname+0x154/0x1a0 [ 667.125051][ T9805] ? _pfxdownreadkillable+0x10/0x10 [ 667.125058][ T9805] ? apparmorfilepermission+0x239/0x3e0 [ 667.125069][ T9805] iteratedir+0x296/0xb20 [ 667.125076][ T9805] _x64sysgetdents64+0x13c/0x2c0 [ 667.125084][ T9805] ? _pfxx64sysgetdents64+0x10/0x10 [ 667.125091][ T9805] ? _x64sysopenat+0x141/0x200 [ 667.125126][ T9805] ? _pfxfilldir64+0x10/0x10 [ 667.125134][ T9805] ? douseraddrfault+0x7fe/0x12f0 [ 667.125143][ T9805] dosyscall64+0xc9/0x480 [ 667.125151][ T9805] entrySYSCALL64afterhwframe+0x77/0x7f [ 667.125158][ T9805] RIP: 0033:0x7fa8753b2fc9 [ 667.125164][ T9805] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 48 [ 667.125172][ T9805] RSP: 002b:00007ffe96f8e0f8 EFLAGS: 00000217 ORIGRAX: 00000000000000d9 [ 667.125181][ T9805] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa8753b2fc9 [ 667.125185][ T9805] RDX: 0000000000000400 RSI: 00002000000063c0 RDI: 0000000000000004 [ 667.125190][ T9805] RBP: 00007ffe96f8e110 R08: 00007ffe96f8e110 R09: 00007ffe96f8e110 [ 667.125195][ T9805] R10: 0000000000000000 R11: 0000000000000217 R12: 0000556b1e3b4260 [ 667.125199][ T9805] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 667.125207][ T9805] </TASK> [ 667.125210][ T9805] [ 667.145632][ T9805] Allocated by task 9805: [ 667.145991][ T9805] kasansavestack+0x20/0x40 [ 667.146352][ T9805] kasansavetrack+0x14/0x30 [ 667.146717][ T9805] _kasankmalloc+0xaa/0xb0 [ 667.147065][ T9805] _kmallocnoprof+0x205/0x550 [ 667.147448][ T9805] hfsplusfindinit+0x95/0x1f0 [ 667.147813][ T9805] hfsplusreaddir+0x220/0xfc0 [ 667.148174][ T9805] iteratedir+0x296/0xb20 [ 667.148549][ T9805] _x64sysgetdents64+0x13c/0x2c0 [ 667.148937][ T9805] dosyscall64+0xc9/0x480 [ 667.149291][ T9805] entrySYSCALL64after_hwframe+0x77/0x7f [ 667.149809][ T9805] [ 667.150030][ T9805] The buggy address belongs to the object at ffff88802592f000 [ 667.150030][ T9805] which belongs to the cache kmalloc-2k of size 2048 [ 667.151282][ T9805] The buggy address is located 0 bytes to the right of [ 667.151282][ T9805] allocated 1036-byte region [ffff88802592f000, ffff88802592f40c) [ 667.1 ---truncated---
[
{
"signature_version": "v1",
"id": "CVE-2025-38713-0a07f6a7",
"digest": {
"threshold": 0.9,
"line_hashes": [
"147314803814397767896783000664203849055",
"85592537459682417074724696496328015336",
"335418169986824840687096182790876333877",
"255604184294731163569333750374776498010",
"162502275388779016984470595307748500147"
]
},
"deprecated": false,
"target": {
"file": "fs/hfsplus/unicode.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ccf0ad56a779e6704c0b27f555dec847f50c7557"
},
{
"signature_version": "v1",
"id": "CVE-2025-38713-0be20dda",
"digest": {
"threshold": 0.9,
"line_hashes": [
"147314803814397767896783000664203849055",
"85592537459682417074724696496328015336",
"335418169986824840687096182790876333877",
"255604184294731163569333750374776498010",
"162502275388779016984470595307748500147"
]
},
"deprecated": false,
"target": {
"file": "fs/hfsplus/unicode.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13604b1d7e7b125fb428cddbec6b8d92baad25d5"
},
{
"signature_version": "v1",
"id": "CVE-2025-38713-66337664",
"digest": {
"function_hash": "52684548797538994594323729368948387145",
"length": 2038.0
},
"deprecated": false,
"target": {
"file": "fs/hfsplus/unicode.c",
"function": "hfsplus_uni2asc"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@76a4c6636a69d69409aa253b049b1be717a539c5"
},
{
"signature_version": "v1",
"id": "CVE-2025-38713-6afaa045",
"digest": {
"threshold": 0.9,
"line_hashes": [
"147314803814397767896783000664203849055",
"85592537459682417074724696496328015336",
"335418169986824840687096182790876333877",
"255604184294731163569333750374776498010",
"162502275388779016984470595307748500147"
]
},
"deprecated": false,
"target": {
"file": "fs/hfsplus/unicode.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@73f7da507d787b489761a0fa280716f84fa32b2f"
},
{
"signature_version": "v1",
"id": "CVE-2025-38713-7a071dc0",
"digest": {
"function_hash": "52684548797538994594323729368948387145",
"length": 2038.0
},
"deprecated": false,
"target": {
"file": "fs/hfsplus/unicode.c",
"function": "hfsplus_uni2asc"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13604b1d7e7b125fb428cddbec6b8d92baad25d5"
},
{
"signature_version": "v1",
"id": "CVE-2025-38713-94108309",
"digest": {
"threshold": 0.9,
"line_hashes": [
"147314803814397767896783000664203849055",
"85592537459682417074724696496328015336",
"335418169986824840687096182790876333877",
"255604184294731163569333750374776498010",
"162502275388779016984470595307748500147"
]
},
"deprecated": false,
"target": {
"file": "fs/hfsplus/unicode.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@291bb5d931c6f3cd7227b913302a17be21cf53b0"
},
{
"signature_version": "v1",
"id": "CVE-2025-38713-a687a2af",
"digest": {
"function_hash": "52684548797538994594323729368948387145",
"length": 2038.0
},
"deprecated": false,
"target": {
"file": "fs/hfsplus/unicode.c",
"function": "hfsplus_uni2asc"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6f93694bcbc2c2ab3e01cd8fba2f296faf34e6b9"
},
{
"signature_version": "v1",
"id": "CVE-2025-38713-b47d2576",
"digest": {
"threshold": 0.9,
"line_hashes": [
"147314803814397767896783000664203849055",
"85592537459682417074724696496328015336",
"335418169986824840687096182790876333877",
"255604184294731163569333750374776498010",
"162502275388779016984470595307748500147"
]
},
"deprecated": false,
"target": {
"file": "fs/hfsplus/unicode.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@76a4c6636a69d69409aa253b049b1be717a539c5"
},
{
"signature_version": "v1",
"id": "CVE-2025-38713-b9b63dba",
"digest": {
"threshold": 0.9,
"line_hashes": [
"147314803814397767896783000664203849055",
"85592537459682417074724696496328015336",
"335418169986824840687096182790876333877",
"255604184294731163569333750374776498010",
"162502275388779016984470595307748500147"
]
},
"deprecated": false,
"target": {
"file": "fs/hfsplus/unicode.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6f93694bcbc2c2ab3e01cd8fba2f296faf34e6b9"
},
{
"signature_version": "v1",
"id": "CVE-2025-38713-c43cad2c",
"digest": {
"function_hash": "52684548797538994594323729368948387145",
"length": 2038.0
},
"deprecated": false,
"target": {
"file": "fs/hfsplus/unicode.c",
"function": "hfsplus_uni2asc"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@73f7da507d787b489761a0fa280716f84fa32b2f"
},
{
"signature_version": "v1",
"id": "CVE-2025-38713-c485eb8b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"147314803814397767896783000664203849055",
"85592537459682417074724696496328015336",
"335418169986824840687096182790876333877",
"255604184294731163569333750374776498010",
"162502275388779016984470595307748500147"
]
},
"deprecated": false,
"target": {
"file": "fs/hfsplus/unicode.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1ca69007e52a73bd8b84b988b61b319816ca8b01"
},
{
"signature_version": "v1",
"id": "CVE-2025-38713-c8615fd8",
"digest": {
"function_hash": "52684548797538994594323729368948387145",
"length": 2038.0
},
"deprecated": false,
"target": {
"file": "fs/hfsplus/unicode.c",
"function": "hfsplus_uni2asc"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f7534cbfac0a9ffa4fa17cacc6e8b6446dae24ee"
},
{
"signature_version": "v1",
"id": "CVE-2025-38713-ca7f864f",
"digest": {
"threshold": 0.9,
"line_hashes": [
"147314803814397767896783000664203849055",
"85592537459682417074724696496328015336",
"335418169986824840687096182790876333877",
"255604184294731163569333750374776498010",
"162502275388779016984470595307748500147"
]
},
"deprecated": false,
"target": {
"file": "fs/hfsplus/unicode.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f7534cbfac0a9ffa4fa17cacc6e8b6446dae24ee"
},
{
"signature_version": "v1",
"id": "CVE-2025-38713-d7ef4b1e",
"digest": {
"threshold": 0.9,
"line_hashes": [
"147314803814397767896783000664203849055",
"85592537459682417074724696496328015336",
"335418169986824840687096182790876333877",
"255604184294731163569333750374776498010",
"162502275388779016984470595307748500147"
]
},
"deprecated": false,
"target": {
"file": "fs/hfsplus/unicode.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94458781aee6045bd3d0ad4b80b02886b9e2219b"
},
{
"signature_version": "v1",
"id": "CVE-2025-38713-d862807e",
"digest": {
"function_hash": "52684548797538994594323729368948387145",
"length": 2038.0
},
"deprecated": false,
"target": {
"file": "fs/hfsplus/unicode.c",
"function": "hfsplus_uni2asc"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@291bb5d931c6f3cd7227b913302a17be21cf53b0"
},
{
"signature_version": "v1",
"id": "CVE-2025-38713-e148486d",
"digest": {
"function_hash": "52684548797538994594323729368948387145",
"length": 2038.0
},
"deprecated": false,
"target": {
"file": "fs/hfsplus/unicode.c",
"function": "hfsplus_uni2asc"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ccf0ad56a779e6704c0b27f555dec847f50c7557"
},
{
"signature_version": "v1",
"id": "CVE-2025-38713-e956b62a",
"digest": {
"function_hash": "52684548797538994594323729368948387145",
"length": 2038.0
},
"deprecated": false,
"target": {
"file": "fs/hfsplus/unicode.c",
"function": "hfsplus_uni2asc"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94458781aee6045bd3d0ad4b80b02886b9e2219b"
},
{
"signature_version": "v1",
"id": "CVE-2025-38713-f193bad6",
"digest": {
"function_hash": "52684548797538994594323729368948387145",
"length": 2038.0
},
"deprecated": false,
"target": {
"file": "fs/hfsplus/unicode.c",
"function": "hfsplus_uni2asc"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1ca69007e52a73bd8b84b988b61b319816ca8b01"
}
]