Executive brief
A vulnerability in the Linux kernel's JFFS2 file system could allow a local user to crash the system or potentially access restricted memory. The issue occurs when handling large file attributes, which can cause the file system to overwrite its own internal structures. This can lead to data corruption or a complete system failure (Blue Screen/Kernel Panic).
Technical details
A vulnerability exists in the JFFS2 file system implementation within the Linux kernel where xattr nodes are not properly validated against the eraseblock size. Unlike standard inode nodes, xattr nodes in JFFS2 cannot be split across multiple eraseblocks. If a user requests an xattr value large enough that the resulting node exceeds the size of a single eraseblock (minus the cleanmarker), the node spills into the adjacent eraseblock. This results in metadata corruption, CRC failures, and out-of-bounds memory access (CWE-125) during subsequent file system operations. The fix introduces a size check in 'do_jffs2_setxattr' to ensure the requested size fits within the sector limits.
Affected products
- Linux Linux Kernel 2.6.18 to 4.19.316, 4.20 to 5.4.278, 5.5 to 5.10.219, 5.11 to 5.15.161, 5.16 to 6.1.93, 6.2 to 6.6.33, 6.7 to 6.8.12, 6.9 to 6.9.3
Timeline
- 2024-04-12: other: Patch submitted by developer
- 2024-06-16: patched: Commits merged into stable branches
- 2024-06-19: advisory: CVE published
References
- https://git.kernel.org/stable/c/2904e1d9b64f72d291095e3cbb31634f08788b11
- https://git.kernel.org/stable/c/526235dffcac74c7823ed504dfac4f88d84ba5df
- https://git.kernel.org/stable/c/8d431391320c5c5398ff966fb3a95e68a7def275
- https://git.kernel.org/stable/c/978a12c91b38bf1a213e567f3c20e2beef215f07
- https://git.kernel.org/stable/c/a1d21bcd78cf4a4353e1e835789429c6b76aca8b
- https://git.kernel.org/stable/c/af82d8d2179b7277ad627c39e7e0778f1c86ccdb
- https://git.kernel.org/stable/c/c6854e5a267c28300ff045480b5a7ee7f6f1d913