Executive brief
A vulnerability exists in the Linux kernel's JFS file system component. A local attacker could exploit a race condition during specific file system operations to cause a system crash or potentially execute unauthorized actions. This occurs when the system attempts to access memory that has already been freed, impacting the stability and security of systems using JFS.
Technical details
A use-after-free (UAF) vulnerability exists in the JFS file system within the dbFreeBits function. The issue is rooted in a race condition between the dbUnmount and jfs_ioc_trim code paths when accessing the block map (bmap) structure. An attacker with local access can trigger this by concurrently executing ioctl commands (FITRIM) and file system reconfiguration/unmount operations. This leads to a slab-use-after-free during mutex locking. The fix involves using the s_umount semaphore to properly synchronize access to the block map during trim operations. Patching is available in various stable kernel branches (e.g., 6.11.3, 6.10.14, 6.6.55).
Affected products
- Linux Linux Kernel up to 5.10.227, 5.11 to 5.15.168, 5.16 to 6.1.113, 6.2 to 6.6.55, 6.7 to 6.10.14, 6.11 to 6.11.3
Timeline
- 2024-08-24: other: Patch authored
- 2024-10-21: advisory: NVD publication date
References
- https://git.kernel.org/stable/c/0c238da83f56bb895cab1e5851d034ac45b158d1
- https://git.kernel.org/stable/c/3126ccde51f51b0648c8cdccaf916e8bd062e972
- https://git.kernel.org/stable/c/4218b31ecc7af7e191768d32e32ed4386d8f9b76
- https://git.kernel.org/stable/c/4ac58f7734937f3249da734ede946dfb3b1af5e4
- https://git.kernel.org/stable/c/95accb7183badca387f7a8d19a2475cf3089f148
- https://git.kernel.org/stable/c/a9603a6f75df2fd8125cd208c98cfaa0fe3f7505
- https://git.kernel.org/stable/c/d6c1b3599b2feb5c7291f5ac3a36e5fa7cedb234