CVE-2024-50230: nilfs2: fix kernel bug due to missing clearing of checked flag
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix kernel bug due to missing clearing of checked flag
Syzbot reported that in directory operations after nilfs2 detects filesystem corruption and degrades to read-only, blockwritebeginint(), which is called to prepare block writes, may fail the BUGON check for accesses exceeding the folio/page size, triggering a kernel bug.
This was found to be because the "checked" flag of a page/folio was not cleared when it was discarded by nilfs2's own routine, which causes the sanity check of directory entries to be skipped when the directory page/folio is reloaded. So, fix that.
This was necessary when the use of nilfs2's own page discard routine was applied to more than just metadata files.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.15.173.1-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.64.2-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50230?
CVE-2024-50230 is classified as a moderate severity vulnerability affecting the Linux kernel.
How do I fix CVE-2024-50230?
To fix CVE-2024-50230, update the Linux kernel to a version that includes the patch for this vulnerability.
What versions of the Linux kernel are affected by CVE-2024-50230?
CVE-2024-50230 affects multiple versions of the Linux kernel ranging from 3.10 to 6.12-rc5.
Is CVE-2024-50230 applicable to all Linux distributions?
CVE-2024-50230 is relevant to any Linux distribution that utilizes the affected versions of the Linux kernel.
What should I do if I'm unable to apply the patch for CVE-2024-50230?
If unable to patch for CVE-2024-50230, consider implementing additional security measures such as restricting file system access.