CVE-2024-39472CWE-770denial-of-service

CVE-2024-39472

High · published July 5, 2024

CVSS v3.1
7.3
EPSS
0%
Percentile
15.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

xfs: fix log recovery buffer allocation for the legacy h_size fixup

Commit a70f9fe52daa ("xfs: detect and handle invalid iclog size set by

mkfs") added a fixup for incorrect h_size values used for the initial

umount record in old xfsprogs versions. Later commit 0c771b99d6c9

("xfs: clean up calculation of LR header blocks") cleaned up the log

reover buffer calculation, but stoped using the fixed up h_size value

to size the log recovery buffer, which can lead to an out of bounds

access when the incorrect h_size does not come from the old mkfs

tool, but a fuzzer.

Fix this by open coding xlog_logrec_hblks and taking the fixed h_size

into account for this calculation.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00251 · 15.7th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2024-07-05T11:15Z
Affected products (1)
ProductVersionsFixed in
linux/linux_kernel≤ 6.9.3—
References (6)
EPSS history
Timeline
  • 05 JUL 06:42Z
    xfs: fix log recovery buffer allocation for the legacy h_size fixup
    cvelistv5