linux-cve-announce - CVE-2024-49900: jfs: Fix uninit-value access of new_ea in ea

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024102120-CVE-2024-49900-1a7d@gregkh>
Date: Mon, 21 Oct 2024 20:01:48 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-49900: jfs: Fix uninit-value access of new_ea in ea_buffer

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

jfs: Fix uninit-value access of new_ea in ea_buffer

syzbot reports that lzo1x_1_do_compress is using uninit-value:

=====================================================
BUG: KMSAN: uninit-value in lzo1x_1_do_compress+0x19f9/0x2510 lib/lzo/lzo1x_compress.c:178

...

Uninit was stored to memory at:
 ea_put fs/jfs/xattr.c:639 [inline]

...

Local variable ea_buf created at:
 __jfs_setxattr+0x5d/0x1ae0 fs/jfs/xattr.c:662
 __jfs_xattr_set+0xe6/0x1f0 fs/jfs/xattr.c:934

=====================================================

The reason is ea_buf->new_ea is not initialized properly.

Fix this by using memset to empty its content at the beginning
in ea_get().

The Linux kernel CVE team has assigned CVE-2024-49900 to this issue.


Affected and fixed versions
===========================

	Fixed in 5.10.227 with commit 8b1dcf25c26d
	Fixed in 5.15.168 with commit d7444f91a9f9
	Fixed in 6.1.113 with commit 6041536d18c5
	Fixed in 6.6.55 with commit c076b3746224
	Fixed in 6.10.14 with commit 7c244d5b4828
	Fixed in 6.11.3 with commit 8ad8b531de79
	Fixed in 6.12-rc1 with commit 2b59ffad47db

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-49900
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/jfs/xattr.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/8b1dcf25c26d42e4a68c4725ce52a0543c7878cc
	https://git.kernel.org/stable/c/d7444f91a9f93eaa48827087ed0f3381c194181d
	https://git.kernel.org/stable/c/6041536d18c5f51a84bc37cd568cbab61870031e
	https://git.kernel.org/stable/c/c076b3746224982eebdba5c9e4b1467e146c0d64
	https://git.kernel.org/stable/c/7c244d5b48284a770d96ff703df2dfeadf804a73
	https://git.kernel.org/stable/c/8ad8b531de79c348bcb8133e7f5e827b884226af
	https://git.kernel.org/stable/c/2b59ffad47db1c46af25ccad157bb3b25147c35c