mtd AFSV2 OOB

Vulnerability analysis

The AFS v2 flash partition parser trusts two values read directly from flash contents — an image information offset stored in the footer and a region count stored in the image information block — without checking them against the erase block size or the size of a fixed local array. A crafted flash image can set the offset large enough to underflow the erase block calculation, or set the region count to exceed the array bounds, causing the kernel to read beyond a stack-local buffer. This can leak kernel stack data or crash the kernel with a page fault. The fix adds validation that rejects entries whose offset would underflow the erase block or whose region count cannot fit in the local array before either value is used. The parser runs automatically when an MTD device is probed at boot, so an attacker only needs to place a crafted image on the flash chip — typically requiring physical access to the device or a compromised firmware update path.