Executive brief
A vulnerability was identified in the Linux kernel's OCFS2 file system component. The issue involves the use of uninitialized data during certain file attribute operations, which could potentially lead to system instability or a denial-of-service condition. This affects systems using the Oracle Cluster File System (OCFS2) and has been addressed in recent kernel updates.
Technical details
A use of uninitialized resource vulnerability (CWE-908) exists in the Linux kernel's fs/ocfs2/file.c. The function ocfs2_setattr() was found to access attr->ia_mode, attr->ia_uid, and attr->ia_gid within a trace point even when the corresponding flags (ATTR_MODE, ATTR_UID, ATTR_GID) were not set in ia_valid. This results in the passing of uninitialized stack values to from_kuid() and from_kgid(). A local attacker could potentially exploit this to cause a kernel oops or denial-of-service. The fix involves explicitly checking the initialization flags and defaulting to 0 when the attributes are not set. Patches have been backported to multiple stable kernel branches including 4.19, 5.4, 5.10, 5.15, 6.1, 6.6, and 6.11.
Affected products
- Linux Linux Kernel versions up to 6.11.9, and 6.12-rc1 through 6.12-rc7
Timeline
- 2024-11-25: disclosed
- 2024-11-25: advisory
References
- https://git.kernel.org/stable/c/15f34347481648a567db67fb473c23befb796af5
- https://git.kernel.org/stable/c/17ecb40c5cc7755a321fb6148cba5797431ee5b8
- https://git.kernel.org/stable/c/1c28bca1256aecece6e94b26b85cd07e08b0dc90
- https://git.kernel.org/stable/c/1cb5bfc5bfc651982b6203c224d49b7ddacf28bc
- https://git.kernel.org/stable/c/5a72b0d3497b818d8f000c347a7c11801eb27bfc
- https://git.kernel.org/stable/c/9db25c2b41c34963c3ccf473b08171f87670652e
- https://git.kernel.org/stable/c/a0c77e5e3dcbffc7c6080ccc89c037f0c86496cf