CVE-2024-57850: jffs2: Prevent rtime decompress memory corruption
In the Linux kernel, the following vulnerability has been resolved:
jffs2: Prevent rtime decompress memory corruption
The rtime decompression routine does not fully check bounds during the entirety of the decompression pass and can corrupt memory outside the decompression buffer if the compressed data is corrupted. This adds the required check to prevent this failure mode.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-57850?
CVE-2024-57850 is classified as a medium severity vulnerability due to the potential for memory corruption.
How do I fix CVE-2024-57850?
To fix CVE-2024-57850, update your Linux kernel to the latest patched version provided by your distribution.
What systems are affected by CVE-2024-57850?
CVE-2024-57850 affects the Linux kernel versions prior to the fix implemented in the latest updates.
What type of vulnerability is CVE-2024-57850?
CVE-2024-57850 is a memory corruption vulnerability caused by improper bounds checking during the rtime decompression process.
Can CVE-2024-57850 be exploited remotely?
While CVE-2024-57850 primarily impacts kernel memory, exploitation may require local access to the system, making remote exploitation less likely.