GHSA-gg3m-4m9m-268h
CVE Information
A malicious peer marks a file entry FLAG_HLINKED even though hard links were not negotiated (-H absent), which the receiver accepted. (Accepting the flag on a DIRECTORY entry was a second invalid form closed by the same fix; the demonstrated write is on a regular file.) The HLINK_BUMP()/OPT_EXTRA offset computed for such an entry then places attacker-supplied bytes just outside the pool entry that was allocated for it.
Reaching the write requires protocol-30 incremental recursion, a regular file, --checksum in use, and -H absent: the extra hard-link slots are reserved only when preserve_hard_links is set, and the out-of-bounds write lands through F_SUM(file).
Fixed by refusing FLAG_HLINKED when hard links are not in use and refusing it on a directory entry.
Affected: 3.0.0 through 3.4.4
Fixed in: 3.5.0 (part of the malicious-peer robustness work)
Reporter: Greg Kroah-Hartman (daemon-protocol fuzzing)
Test: proto-hlink-flag-oob