Executive brief
A vulnerability in the Linux kernel's NILFS2 file system could allow a local user to crash the system. The issue occurs when the system attempts to process a specially crafted or corrupted file system image. This could lead to a denial-of-service condition, impacting system availability and ongoing operations.
Technical details
A NULL pointer dereference exists in nilfs_btree_prepare_insert() within the NILFS2 file system implementation. The vulnerability is triggered when a B-tree root node is inconsistent (e.g., having a height greater than 2 but zero child nodes). In such cases, nilfs_btree_do_lookup() fails to initialize the block buffer head (path[x].bp_bh), which is subsequently accessed by nilfs_btree_get_nonroot_node(). An attacker with the ability to mount a corrupted NILFS2 image or manipulate filesystem structures can trigger this flaw to cause a kernel panic (Denial of Service). The fix introduces additional sanity checks in nilfs_btree_root_broken() to validate the relationship between node level and child count.
Affected products
- Linux Linux Kernel 2.6.30 to 5.10.226, 5.11 to 5.15.167, 5.16 to 6.1.112, 6.2 to 6.6.53, 6.7 to 6.10.12, 6.11 to 6.11.1
Timeline
- 2024-09-04: patched: Initial patch authored
- 2024-10-21: advisory: CVE published by NVD
References
- https://git.kernel.org/stable/c/1d94dbdfbb64cc48d10dec65cc3c4fbf2497b343
- https://git.kernel.org/stable/c/21839b6fbc3c41b3e374ecbdb0cabbbb2c53cf34
- https://git.kernel.org/stable/c/24bf40740a3da6b4056721da34997ae6938f3da1
- https://git.kernel.org/stable/c/2b78e9df10fb7f4e9d3d7a18417dd72fbbc1dfd0
- https://git.kernel.org/stable/c/3644554d308ddf2669e459a1551a7edf60b2d62b
- https://git.kernel.org/stable/c/73d23ecf234b7a6d47fb883f2dabe10e3230b31d
- https://git.kernel.org/stable/c/9403001ad65ae4f4c5de368bdda3a0636b51d51a