CVE-2024-49957: ocfs2: fix null-ptr-deref when journal load failed.
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: fix null-ptr-deref when journal load failed.
During the mounting process, if journalreset() fails because of too short journal, then lead to jbd2journalload() fails with NULL jsbbuffer. Subsequently, ocfs2journalshutdown() calls jbd2journalflush()->jbd2cleanupjournaltail()-> jbd2updatelogtail()->jbd2journalupdatesblogtail() ->lockbuffer(journal->jsbbuffer), resulting in a null-pointer dereference error.
To resolve this issue, we should check the JBD2LOADED flag to ensure the journal was properly loaded. Additionally, use journal instead of osb->journal directly to simplify the code.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-49957?
CVE-2024-49957 has a moderate severity rating due to the potential for a null pointer dereference.
How do I fix CVE-2024-49957?
To fix CVE-2024-49957, update your Linux kernel to version 6.1.123-1, 6.1.119-1, or any later version that addresses the vulnerability.
What systems are affected by CVE-2024-49957?
CVE-2024-49957 affects various versions of the Linux kernel including versions between 2.6.32 and 6.10.14.
What is the impact of CVE-2024-49957?
The impact of CVE-2024-49957 includes potential system crashes due to null pointer dereferences during journal loading.
Does CVE-2024-49957 require user interaction to exploit?
CVE-2024-49957 does not require user interaction to exploit, as it can occur automatically during the mounting process.