{"id":"CVE-2024-39472","state":"PUBLISHED","title":"xfs: fix log recovery buffer allocation for the legacy h_size fixup","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix log recovery buffer allocation for the legacy h_size fixup\n\nCommit a70f9fe52daa (\"xfs: detect and handle invalid iclog size set by\nmkfs\") added a fixup for incorrect h_size values used for the initial\numount record in old xfsprogs versions.  Later commit 0c771b99d6c9\n(\"xfs: clean up calculation of LR header blocks\") cleaned up the log\nreover buffer calculation, but stoped using the fixed up h_size value\nto size the log recovery buffer, which can lead to an out of bounds\naccess when the incorrect h_size does not come from the old mkfs\ntool, but a fuzzer.\n\nFix this by open coding xlog_logrec_hblks and taking the fixed h_size\ninto account for this calculation.","publishedAt":"2024-07-05T06:42:03.495Z","updatedAt":"2026-08-05T11:33:29.670Z","severity":{"score":7.3,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"0c771b99d6c9a0552fea5cc43669b726dad8f659","status":"affected","lessThan":"f754591b17d0ee91c2b45fe9509d0cdc420527cb","versionType":"git"},{"version":"0c771b99d6c9a0552fea5cc43669b726dad8f659","status":"affected","lessThan":"57835c0e7152e36b03875dd6c56dfeed685c1b1f","versionType":"git"},{"version":"0c771b99d6c9a0552fea5cc43669b726dad8f659","status":"affected","lessThan":"c2389c074973aa94e34992e7f66dac0de37595b5","versionType":"git"},{"version":"0c771b99d6c9a0552fea5cc43669b726dad8f659","status":"affected","lessThan":"45cf976008ddef4a9c9a30310c9b4fb2a9a6602a","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/xfs/xfs_log_recover.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.10","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.10","versionType":"semver"},{"version":"5.15.165","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.105","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.46","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.10","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/xfs/xfs_log_recover.c"]}],"references":["https://git.kernel.org/stable/c/f754591b17d0ee91c2b45fe9509d0cdc420527cb","https://git.kernel.org/stable/c/57835c0e7152e36b03875dd6c56dfeed685c1b1f","https://git.kernel.org/stable/c/c2389c074973aa94e34992e7f66dac0de37595b5","https://git.kernel.org/stable/c/45cf976008ddef4a9c9a30310c9b4fb2a9a6602a","https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"],"weaknesses":[],"ingestedAt":"2026-10-29T20:07:39.287Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/39xxx/CVE-2024-39472.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-39472","state":"PUBLISHED","datePublished":"2024-07-05T06:42:03.495Z","dateUpdated":"2026-08-05T11:33:29.670Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-06-25T14:23:23.745Z"},"containers":{"cna":{"title":"xfs: fix log recovery buffer allocation for the legacy h_size fixup","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix log recovery buffer allocation for the legacy h_size fixup\n\nCommit a70f9fe52daa (\"xfs: detect and handle invalid iclog size set by\nmkfs\") added a fixup for incorrect h_size values used for the initial\numount record in old xfsprogs versions.  Later commit 0c771b99d6c9\n(\"xfs: clean up calculation of LR header blocks\") cleaned up the log\nreover buffer calculation, but stoped using the fixed up h_size value\nto size the log recovery buffer, which can lead to an out of bounds\naccess when the incorrect h_size does not come from the old mkfs\ntool, but a fuzzer.\n\nFix this by open coding xlog_logrec_hblks and taking the fixed h_size\ninto account for this calculation."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"0c771b99d6c9a0552fea5cc43669b726dad8f659","status":"affected","lessThan":"f754591b17d0ee91c2b45fe9509d0cdc420527cb","versionType":"git"},{"version":"0c771b99d6c9a0552fea5cc43669b726dad8f659","status":"affected","lessThan":"57835c0e7152e36b03875dd6c56dfeed685c1b1f","versionType":"git"},{"version":"0c771b99d6c9a0552fea5cc43669b726dad8f659","status":"affected","lessThan":"c2389c074973aa94e34992e7f66dac0de37595b5","versionType":"git"},{"version":"0c771b99d6c9a0552fea5cc43669b726dad8f659","status":"affected","lessThan":"45cf976008ddef4a9c9a30310c9b4fb2a9a6602a","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/xfs/xfs_log_recover.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.10","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.10","versionType":"semver"},{"version":"5.15.165","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.105","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.46","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.10","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/xfs/xfs_log_recover.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/f754591b17d0ee91c2b45fe9509d0cdc420527cb"},{"url":"https://git.kernel.org/stable/c/57835c0e7152e36b03875dd6c56dfeed685c1b1f"},{"url":"https://git.kernel.org/stable/c/c2389c074973aa94e34992e7f66dac0de37595b5"},{"url":"https://git.kernel.org/stable/c/45cf976008ddef4a9c9a30310c9b4fb2a9a6602a"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H","baseScore":7.3,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through XFS log recovery at mount time on a locally attached block device or image file; no network or remote-peer data reaches this code. Delivery via removable media still requires the image to be mounted on the local system.\nAC:L - Every input is attacker-chosen on-disk data — `sb_logsunit` (raises `m_logbsize` to 256K with no mount option needed), and `h_size`/`h_len`/`h_num_logops`/`h_version` in the tail log record — so the undersized `hbp` and the ~224 KB overread happen deterministically on every mount, with no race and no memory layout to groom.\nPR:N - The attacker needs no account or privilege on the target; they only need to hand over a crafted XFS image (USB stick, disk image, exported LUN) that is then mounted by the victim or by an automounter such as udisks2 on a desktop or kiosk. Equivalently, an unprivileged local user on an automount-enabled system reaches it with PR:L/UI:N, which yields the identical exploitability score.\nUI:R - A user or automount service must mount the malicious filesystem with a dirty log so that `xlog_do_recovery_pass()` runs; the attacker cannot initiate the mount themselves.\nS:U - The out-of-bounds access and its consequences stay inside the kernel's own security authority — no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - `xlog_cksum()` and `xlog_unpack_data()` read at 32 KB strides up to ~224 KB past a 512-byte `kvzalloc()` slab object, and on a non-CRC (v4) image the harvested heap dwords are copied into the replayed log data and committed to the filesystem, giving the attacker a large, readable kernel heap disclosure.\nI:L - There is no out-of-bounds write — `dbp` is sized from the fixed-up `h_size` and `bblks <= BTOBB(h_size)` — but the out-of-bounds kernel heap dwords are spliced into the log record data by `xlog_unpack_data()` and replayed into on-disk metadata, producing limited, attacker-uncontrolled modification of filesystem data.\nA:H - Reading roughly 224 KB beyond a 512-byte slab allocation readily crosses into unmapped memory, producing a page fault/oops (or a KASAN slab-out-of-bounds panic) during mount, taking down the system."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T11:33:29.670Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"5.15.165"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"6.1.105"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"6.6.46"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"6.10"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/45cf976008ddef4a9c9a30310c9b4fb2a9a6602a","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T21:56:05.270Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-39472","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-09-10T17:07:45.783551Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-09-11T17:34:41.426Z"}}]}}}