| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2024110929-CVE-2024-50230-0b5e@gregkh> Date: Sat, 9 Nov 2024 11:15:38 +0100 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org> Subject: CVE-2024-50230: nilfs2: fix kernel bug due to missing clearing of checked flag Description =========== In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix kernel bug due to missing clearing of checked flag Syzbot reported that in directory operations after nilfs2 detects filesystem corruption and degrades to read-only, __block_write_begin_int(), which is called to prepare block writes, may fail the BUG_ON check for accesses exceeding the folio/page size, triggering a kernel bug. This was found to be because the "checked" flag of a page/folio was not cleared when it was discarded by nilfs2's own routine, which causes the sanity check of directory entries to be skipped when the directory page/folio is reloaded. So, fix that. This was necessary when the use of nilfs2's own page discard routine was applied to more than just metadata files. The Linux kernel CVE team has assigned CVE-2024-50230 to this issue. Affected and fixed versions =========================== Issue introduced in 3.10 with commit 8c26c4e2694a and fixed in 4.19.323 with commit 994b2fa13a6c Issue introduced in 3.10 with commit 8c26c4e2694a and fixed in 5.4.285 with commit 64afad73e462 Issue introduced in 3.10 with commit 8c26c4e2694a and fixed in 5.10.229 with commit aa0cee46c5d3 Issue introduced in 3.10 with commit 8c26c4e2694a and fixed in 5.15.171 with commit f05dbebb8ee3 Issue introduced in 3.10 with commit 8c26c4e2694a and fixed in 6.1.116 with commit cd0cdb51b152 Issue introduced in 3.10 with commit 8c26c4e2694a and fixed in 6.6.60 with commit f2f1fa446676 Issue introduced in 3.10 with commit 8c26c4e2694a and fixed in 6.11.7 with commit 56c6171932a7 Issue introduced in 3.10 with commit 8c26c4e2694a and fixed in 6.12-rc6 with commit 41e192ad2779 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2024-50230 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/nilfs2/page.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/994b2fa13a6c9cf3feca93090a9c337d48e3d60d https://git.kernel.org/stable/c/64afad73e4623308d8943645e5631f2c7a2d7971 https://git.kernel.org/stable/c/aa0cee46c5d3fd9a39575a4c8a4f65f25f095b89 https://git.kernel.org/stable/c/f05dbebb8ee34882505d53d83af7d18f28a49248 https://git.kernel.org/stable/c/cd0cdb51b15203fa27d4b714be83b7dfffa0b752 https://git.kernel.org/stable/c/f2f1fa446676c21edb777e6d2bc4fa8f956fab68 https://git.kernel.org/stable/c/56c6171932a7fb267ac6cb4ff8759b93ee1d0e2e https://git.kernel.org/stable/c/41e192ad2779cae0102879612dfe46726e4396aa
Powered by blists - more mailing lists