CVE-2024-49900: jfs: Fix uninit-value access of new_ea in ea_buffer
In the Linux kernel, the following vulnerability has been resolved:
jfs: Fix uninit-value access of newea in eabuffer
syzbot reports that lzo1x1docompress is using uninit-value:
===================================================== BUG: KMSAN: uninit-value in lzo1x1docompress+0x19f9/0x2510 lib/lzo/lzo1xcompress.c:178
...
Uninit was stored to memory at: eaput fs/jfs/xattr.c:639 [inline]
...
Local variable eabuf created at: jfssetxattr+0x5d/0x1ae0 fs/jfs/xattr.c:662 jfsxattrset+0xe6/0x1f0 fs/jfs/xattr.c:934
=====================================================
The reason is eabuf->newea is not initialized properly.
Fix this by using memset to empty its content at the beginning in eaget().
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-49900?
CVE-2024-49900 is considered a moderate severity vulnerability affecting certain versions of the Linux kernel.
How do I fix CVE-2024-49900?
To fix CVE-2024-49900, upgrade your Linux kernel to a version that is not affected, such as 6.1.123-1 or newer.
Which versions of the Linux kernel are affected by CVE-2024-49900?
CVE-2024-49900 affects Linux kernel versions from 5.11 to 6.11.3, excluding patched releases.
Is CVE-2024-49900 being actively exploited?
There is currently no public evidence that CVE-2024-49900 is being actively exploited in the wild.
What components in the Linux kernel are affected by CVE-2024-49900?
CVE-2024-49900 affects the jfs (Journaling File System) component related to uninitialized value access.