CVE-2024-50218: ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: pass u64 to ocfs2truncateinline maybe overflow
Syzbot reported a kernel BUG in ocfs2truncateinline. There are two reasons for this: first, the parameter value passed is greater than ocfs2maxinlinedatawithxattr, second, the start and end parameters of ocfs2truncateinline are "unsigned int".
So, we need to add a sanity check for bytestart and bytelen right before ocfs2truncateinline() in ocfs2removeinoderange(), if they are greater than ocfs2maxinlinedatawithxattr return -EINVAL.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50218?
CVE-2024-50218 has been classified as a high severity vulnerability due to the potential for kernel crashes.
How do I fix CVE-2024-50218?
To fix CVE-2024-50218, update your Linux kernel to versions 5.10.234-1, 6.1.128-1, 6.12.12-1, or later.
Which systems are affected by CVE-2024-50218?
CVE-2024-50218 affects specific versions of the Linux kernel, particularly prior to 5.10.234-1 and 6.1.128-1.
What does CVE-2024-50218 impact?
CVE-2024-50218 impacts the ocfs2 file system in the Linux kernel, specifically related to inline data truncation.
Who reported CVE-2024-50218?
CVE-2024-50218 was reported by the Syzbot automated testing tool, indicating a kernel bug.