CVE-2024-56619

nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()

High · published December 27, 2024

CVSS v3.1
7.8
EPSS
0%
Percentile
11.0
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()

Syzbot reported that when searching for records in a directory where the

inode's i_size is corrupted and has a large value, memory access outside

the folio/page range may occur, or a use-after-free bug may be detected if

KASAN is enabled.

This is because nilfs_last_byte(), which is called by nilfs_find_entry()

and others to calculate the number of valid bytes of directory data in a

page from i_size and the page index, loses the upper 32 bits of the 64-bit

size information due to an inappropriate type of local variable to which

the i_size value is assigned.

This caused a large byte offset value due to underflow in the end address

calculation in the calling nilfs_find_entry(), resulting in memory access

that exceeds the folio/page size.

Fix this issue by changing the type of the local variable causing the bit

loss from "unsigned int" to "u64". The return value of nilfs_last_byte()

is also of type "unsigned int", but it is truncated so as not to exceed

PAGE_SIZE and no bit loss occurs, so no change is required.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00213 · 11.0th percentile
Published
2024-12-27T14:51Z
EPSS history
Timeline
  • 27 DEC 14:51Z
    nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()
    cvelistv5