ecryptfs Tag70Packet Underflow

Vulnerability analysis

When eCryptfs parses a tag 70 packet (an encrypted filename), it subtracts fixed metadata field sizes from the packet body size to determine the encrypted filename length. A malformed packet whose body is smaller than those fixed fields causes this subtraction to underflow, producing an extremely large size value that is then used for memory allocation and data copying — potentially corrupting kernel heap memory. The fix adds a validation check that rejects any tag 70 packet whose body is too small to contain the signature, cipher code, and at least one byte of filename data, before the subtraction is performed. The bug can be triggered by any user who accesses a file on an already-mounted eCryptfs filesystem, but the malformed filename must first be planted in the lower filesystem — achievable through removable media, a malicious or MITM'd network filesystem server, or direct write access by a privileged user.