| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2024102131-CVE-2024-49957-3302@gregkh> Date: Mon, 21 Oct 2024 20:02:45 +0200 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org> Subject: CVE-2024-49957: ocfs2: fix null-ptr-deref when journal load failed. Description =========== In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix null-ptr-deref when journal load failed. During the mounting process, if journal_reset() fails because of too short journal, then lead to jbd2_journal_load() fails with NULL j_sb_buffer. Subsequently, ocfs2_journal_shutdown() calls jbd2_journal_flush()->jbd2_cleanup_journal_tail()-> __jbd2_update_log_tail()->jbd2_journal_update_sb_log_tail() ->lock_buffer(journal->j_sb_buffer), resulting in a null-pointer dereference error. To resolve this issue, we should check the JBD2_LOADED flag to ensure the journal was properly loaded. Additionally, use journal instead of osb->journal directly to simplify the code. The Linux kernel CVE team has assigned CVE-2024-49957 to this issue. Affected and fixed versions =========================== Issue introduced in 2.6.32 with commit f6f50e28f0cb and fixed in 5.10.227 with commit bf605ae98dab Issue introduced in 2.6.32 with commit f6f50e28f0cb and fixed in 5.15.168 with commit ff55291fb367 Issue introduced in 2.6.32 with commit f6f50e28f0cb and fixed in 6.1.113 with commit 82dfdd1e31e7 Issue introduced in 2.6.32 with commit f6f50e28f0cb and fixed in 6.6.55 with commit 86a89e75e9e4 Issue introduced in 2.6.32 with commit f6f50e28f0cb and fixed in 6.10.14 with commit f60e94a83db7 Issue introduced in 2.6.32 with commit f6f50e28f0cb and fixed in 6.11.3 with commit 387bf565cc03 Issue introduced in 2.6.32 with commit f6f50e28f0cb and fixed in 6.12-rc1 with commit 5784d9fcfd43 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2024-49957 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/ocfs2/journal.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/bf605ae98dab5c15c5b631d4d7f88898cb41b649 https://git.kernel.org/stable/c/ff55291fb36779819211b596da703389135f5b05 https://git.kernel.org/stable/c/82dfdd1e31e774578f76ce6dc90c834f96403a0f https://git.kernel.org/stable/c/86a89e75e9e4dfa768b97db466ad6bedf2e7ea5b https://git.kernel.org/stable/c/f60e94a83db799bde625ac8671a5b4a6354e7120 https://git.kernel.org/stable/c/387bf565cc03e2e8c720b8b4798efea4aacb6962 https://git.kernel.org/stable/c/5784d9fcfd43bd853654bb80c87ef293b9e8e80a
Powered by blists - more mailing lists