Zephyr ext2 filesystem driver vulnerabilities

The Zephyr ext2 filesystem driver contains an out-of-bounds read vulnerability triggered when mounting a crafted ext2 image. The ext2_bitmap_count_set() function scans memory based on unvalidated superblock values, potentially reading about 512 MB past the bitmap buffer.

The Zephyr ext2 filesystem driver fails to validate the s_log_block_size field of the on-disk superblock when mounting a filesystem. A crafted image can cause a shift overflow or oversized block size, leading to an out-of-bounds write into static memory in kernel mode.

The Zephyr ext2 filesystem driver trusts on-disk directory entry fields de_rec_len and de_name_len when walking a directory block. The validation of de_name_len is ineffective, allowing up to 263 bytes out-of-bounds read past the block buffer, leading to kernel memory leak, and a de_rec_len of 0 causes an infinite loop (denial of service). Affected versions from v3.5.0 to v4.4.0.