CVE-2024-50218

ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow

published November 9, 2024

CVSS
—
EPSS
0%
Percentile
18.6
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow

Syzbot reported a kernel BUG in ocfs2_truncate_inline. There are two

reasons for this: first, the parameter value passed is greater than

ocfs2_max_inline_data_with_xattr, second, the start and end parameters of

ocfs2_truncate_inline are "unsigned int".

So, we need to add a sanity check for byte_start and byte_len right before

ocfs2_truncate_inline() in ocfs2_remove_inode_range(), if they are greater

than ocfs2_max_inline_data_with_xattr return -EINVAL.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00272 · 18.6th percentile
Published
2024-11-09T10:14Z
EPSS history
Timeline
  • 09 NOV 10:14Z
    ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow
    cvelistv5