CVE-2024-40902: jfs: xattr: fix buffer overflow for invalid xattr
In the Linux kernel, the following vulnerability has been resolved:
jfs: xattr: fix buffer overflow for invalid xattr
When an xattr size is not what is expected, it is printed out to the kernel log in hex format as a form of debugging. But when that xattr size is bigger than the expected size, printing it out can cause an access off the end of the buffer.
Fix this all up by properly restricting the size of the debug hex dump in the kernel log.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.137-1Fixed in 6.1.135-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch jfs: xattr: fix buffer overflow for invalid xattr
Event History
Frequently Asked Questions
What is the severity of CVE-2024-40902?
CVE-2024-40902 has a high severity rating due to the potential for a buffer overflow leading to system crashes or arbitrary code execution.
How do I fix CVE-2024-40902?
To fix CVE-2024-40902, update the Linux kernel to the latest secure versions such as 5.10.223-1 or 6.1.123-1.
What versions of the Linux kernel are affected by CVE-2024-40902?
CVE-2024-40902 affects various versions of the Linux kernel between 4.19.317 and any version prior to 6.10-rc1.
Does CVE-2024-40902 allow exploitation remotely?
CVE-2024-40902 can potentially be exploited locally, but its impact might be elevated if combined with other vulnerabilities.
What should I do if I cannot upgrade the Linux kernel for CVE-2024-40902?
If unable to upgrade, apply any available backported patches specific to CVE-2024-40902 for your Linux distribution.