Problem Description:
When a fusefs file system implements extended attributes, the
kernel may send a FUSE_LISTXATTR message to the userspace daemon
to retrieve the list of extended attributes for a given file. The
FUSE protocol requires the daemon to return a packed list of
NUL-terminated strings. The fusefs kernel module calls strlen()
on this daemon-supplied buffer without first verifying that the
entire list is NUL-terminated.
Impact:
If a malicious daemon sends a non-NUL-terminated list, the
fusefs kernel module may read beyond the end of one heap-allocated
buffer and potentially write beyond the end of a second buffer. A
malicious daemon could disclose up to 253 bytes of kernel heap
memory, or it could inject up to 250 attacker-controlled bytes into
unallocated kernel heap space.