CVE-2024-56619: nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix potential out-of-bounds memory access in nilfsfindentry()
Syzbot reported that when searching for records in a directory where the inode's isize is corrupted and has a large value, memory access outside the folio/page range may occur, or a use-after-free bug may be detected if KASAN is enabled.
This is because nilfslastbyte(), which is called by nilfsfindentry() and others to calculate the number of valid bytes of directory data in a page from isize and the page index, loses the upper 32 bits of the 64-bit size information due to an inappropriate type of local variable to which the isize value is assigned.
This caused a large byte offset value due to underflow in the end address calculation in the calling nilfsfindentry(), resulting in memory access that exceeds the folio/page size.
Fix this issue by changing the type of the local variable causing the bit loss from "unsigned int" to "u64". The return value of nilfslastbyte() is also of type "unsigned int", but it is truncated so as not to exceed PAGESIZE and no bit loss occurs, so no change is required.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Configuration
In nilfs2, update the local variable(s) in nilfs_find_entry() / nilfs_last_byte() used to assign i_size so the 64-bit i_size upper 32 bits are not truncated: change the local variable type from "unsigned int" to "u64" to prevent underflow/large byte offsets and out-of-bounds memory access.
Linux kernel (nilfs2) Fix out-of-bounds access in nilfs_find_entry() by changing local variable type causing bit loss from "unsigned int" to "u64" = unsigned int -> u64
Event History
Frequently Asked Questions
What is the severity of CVE-2024-56619?
CVE-2024-56619 is classified as a high severity vulnerability due to potential out-of-bounds memory access.
How do I fix CVE-2024-56619?
To fix CVE-2024-56619, update the Linux kernel to the latest version that includes the patch addressing this vulnerability.
What are the potential impacts of CVE-2024-56619?
CVE-2024-56619 can lead to system crashes or unauthorized memory access, affecting system stability and security.
Which versions of the Linux kernel are affected by CVE-2024-56619?
CVE-2024-56619 affects various versions of the Linux kernel that utilize nilfs2 file systems.
How can I determine if my system is vulnerable to CVE-2024-56619?
Check if your current Linux kernel version is prior to the patches that resolve CVE-2024-56619 to assess vulnerability.