CVE-2024-42295: nilfs2: handle inconsistent state in nilfs_btnode_create_block()
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: handle inconsistent state in nilfsbtnodecreateblock()
Syzbot reported that a buffer state inconsistency was detected in nilfsbtnodecreateblock(), triggering a kernel bug.
It is not appropriate to treat this inconsistency as a bug; it can occur if the argument block address (the buffer index of the newly created block) is a virtual block number and has been reallocated due to corruption of the bitmap used to manage its allocation state.
So, modify nilfsbtnodecreateblock() and its callers to treat it as a possible filesystem error, rather than triggering a kernel bug.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42295?
CVE-2024-42295 has been classified with a high severity level due to its potential to cause kernel instability.
How do I fix CVE-2024-42295?
To fix CVE-2024-42295, upgrade to the recommended versions of the Linux kernel: 5.10.226-1, 6.1.123-1, 6.1.128-1, 6.12.12-1, or 6.12.13-1.
Which software packages are affected by CVE-2024-42295?
CVE-2024-42295 affects specific versions of the Linux kernel and linux-6.1 package from Debian.
Who reported the CVE-2024-42295 vulnerability?
The CVE-2024-42295 vulnerability was reported by Syzbot.
What is the main issue addressed in CVE-2024-42295?
CVE-2024-42295 addresses a buffer state inconsistency detected in the nilfs_btnode_create_block() function.