Vulnerability: Heap-based buffer overflow in the verify_vbr_checksum function in exfatfsck in exfat-utils before 1.2.1 allows remote attackers to cause a denial of service (infinite loop) or possibly execute arbitrary code via a crafted filesystem.
Vulnerability ID: CVE-2015-8026
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/relan/exfat
Published: 2017-03-27
File: libexfat/mount.c
Commit message: Check sector and cluster size before use.

Otherwise malformed FS can cause heap corruption.
Commit author: relan

Vulnerable version (before fix):
 int exfat_mount(struct exfat* ef, const char* spec, const char* options) 		exfat_error("exFAT file system is not found"); 		return -EIO; 	} 	ef->zero_cluster = malloc(CLUSTER_SIZE(*ef->sb)); 	if (ef->zero_cluster == NULL) 	{ int exfat_mount(struct exfat* ef, const char* spec, const char* options) 		free(ef->sb); 		return -EIO; 	} 	/* officially exFAT supports cluster size up to 32 MB */ 	if ((int) ef->sb->sector_bits + (int) ef->sb->spc_bits > 25) 	{ 		free(ef->zero_cluster); 		exfat_close(ef->dev); 		exfat_error("too big cluster size: 2^%d", 				(int) ef->sb->sector_bits + (int) ef->sb->spc_bits); 		free(ef->sb); 		return -EIO; 	} 	if (le64_to_cpu(ef->sb->sector_count) * SECTOR_SIZE(*ef->sb) > 			exfat_get_size(ef->dev)) 	{

Fixed version (after fix):
 int exfat_mount(struct exfat* ef, const char* spec, const char* options) 		exfat_error("exFAT file system is not found"); 		return -EIO; 	} 	/* sector cannot be smaller than 512 bytes */ 	if (ef->sb->sector_bits < 9) 	{ 		exfat_close(ef->dev); 		exfat_error("too small sector size: 2^%hhd", ef->sb->sector_bits); 		free(ef->sb); 		return -EIO; 	} 	/* officially exFAT supports cluster size up to 32 MB */ 	if ((int) ef->sb->sector_bits + (int) ef->sb->spc_bits > 25) 	{ 		exfat_close(ef->dev); 		exfat_error("too big cluster size: 2^(%hhd+%hhd)", 				ef->sb->sector_bits, ef->sb->spc_bits); 		free(ef->sb); 		return -EIO; 	} 	ef->zero_cluster = malloc(CLUSTER_SIZE(*ef->sb)); 	if (ef->zero_cluster == NULL) 	{ int exfat_mount(struct exfat* ef, const char* spec, const char* options) 		free(ef->sb); 		return -EIO; 	} 	if (le64_to_cpu(ef->sb->sector_count) * SECTOR_SIZE(*ef->sb) > 			exfat_get_size(ef->dev)) 	{

Patch:
patch: @@ -206,6 +206,23 @@ int exfat_mount(struct exfat* ef, const char* spec, const char* options)
 		exfat_error("exFAT file system is not found");
 		return -EIO;
 	}
+	/* sector cannot be smaller than 512 bytes */
+	if (ef->sb->sector_bits < 9)
+	{
+		exfat_close(ef->dev);
+		exfat_error("too small sector size: 2^%hhd", ef->sb->sector_bits);
+		free(ef->sb);
+		return -EIO;
+	}
+	/* officially exFAT supports cluster size up to 32 MB */
+	if ((int) ef->sb->sector_bits + (int) ef->sb->spc_bits > 25)
+	{
+		exfat_close(ef->dev);
+		exfat_error("too big cluster size: 2^(%hhd+%hhd)",
+				ef->sb->sector_bits, ef->sb->spc_bits);
+		free(ef->sb);
+		return -EIO;
+	}
 	ef->zero_cluster = malloc(CLUSTER_SIZE(*ef->sb));
 	if (ef->zero_cluster == NULL)
 	{
@@ -240,16 +257,6 @@ int exfat_mount(struct exfat* ef, const char* spec, const char* options)
 		free(ef->sb);
 		return -EIO;
 	}
-	/* officially exFAT supports cluster size up to 32 MB */
-	if ((int) ef->sb->sector_bits + (int) ef->sb->spc_bits > 25)
-	{
-		free(ef->zero_cluster);
-		exfat_close(ef->dev);
-		exfat_error("too big cluster size: 2^%d",
-				(int) ef->sb->sector_bits + (int) ef->sb->spc_bits);
-		free(ef->sb);
-		return -EIO;
-	}
 	if (le64_to_cpu(ef->sb->sector_count) * SECTOR_SIZE(*ef->sb) >
 			exfat_get_size(ef->dev))
 	{
path: libexfat/mount.c