{"id":"CVE-2024-47699","state":"PUBLISHED","title":"nilfs2: fix potential null-ptr-deref in nilfs_btree_insert()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix potential null-ptr-deref in nilfs_btree_insert()\n\nPatch series \"nilfs2: fix potential issues with empty b-tree nodes\".\n\nThis series addresses three potential issues with empty b-tree nodes that\ncan occur with corrupted filesystem images, including one recently\ndiscovered by syzbot.\n\n\nThis patch (of 3):\n\nIf a b-tree is broken on the device, and the b-tree height is greater than\n2 (the level of the root node is greater than 1) even if the number of\nchild nodes of the b-tree root is 0, a NULL pointer dereference occurs in\nnilfs_btree_prepare_insert(), which is called from nilfs_btree_insert().\n\nThis is because, when the number of child nodes of the b-tree root is 0,\nnilfs_btree_do_lookup() does not set the block buffer head in any of\npath[x].bp_bh, leaving it as the initial value of NULL, but if the level\nof the b-tree root node is greater than 1, nilfs_btree_get_nonroot_node(),\nwhich accesses the buffer memory of path[x].bp_bh, is called.\n\nFix this issue by adding a check to nilfs_btree_root_broken(), which\nperforms sanity checks when reading the root node from the device, to\ndetect this inconsistency.\n\nThanks to Lizhi Xu for trying to solve the bug and clarifying the cause\nearly on.","publishedAt":"2024-10-21T11:53:35.962Z","updatedAt":"2026-10-15T00:51:46.202Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"17c76b0104e4a6513983777e1a17e0297a12b0c4","status":"affected","lessThan":"2b78e9df10fb7f4e9d3d7a18417dd72fbbc1dfd0","versionType":"git"},{"version":"17c76b0104e4a6513983777e1a17e0297a12b0c4","status":"affected","lessThan":"1d94dbdfbb64cc48d10dec65cc3c4fbf2497b343","versionType":"git"},{"version":"17c76b0104e4a6513983777e1a17e0297a12b0c4","status":"affected","lessThan":"24bf40740a3da6b4056721da34997ae6938f3da1","versionType":"git"},{"version":"17c76b0104e4a6513983777e1a17e0297a12b0c4","status":"affected","lessThan":"73d23ecf234b7a6d47fb883f2dabe10e3230b31d","versionType":"git"},{"version":"17c76b0104e4a6513983777e1a17e0297a12b0c4","status":"affected","lessThan":"f68523e0f26faade18833fbef577a4295d8e2c94","versionType":"git"},{"version":"17c76b0104e4a6513983777e1a17e0297a12b0c4","status":"affected","lessThan":"21839b6fbc3c41b3e374ecbdb0cabbbb2c53cf34","versionType":"git"},{"version":"17c76b0104e4a6513983777e1a17e0297a12b0c4","status":"affected","lessThan":"db73500d3f0e558eb642aae1d4782e7726b4a03f","versionType":"git"},{"version":"17c76b0104e4a6513983777e1a17e0297a12b0c4","status":"affected","lessThan":"3644554d308ddf2669e459a1551a7edf60b2d62b","versionType":"git"},{"version":"17c76b0104e4a6513983777e1a17e0297a12b0c4","status":"affected","lessThan":"9403001ad65ae4f4c5de368bdda3a0636b51d51a","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nilfs2/btree.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.30","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.30","versionType":"semver"},{"version":"4.19.323","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.285","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.227","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.168","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.113","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.54","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.10.13","status":"unaffected","lessThanOrEqual":"6.10.*","versionType":"semver"},{"version":"6.11.2","status":"unaffected","lessThanOrEqual":"6.11.*","versionType":"semver"},{"version":"6.12","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nilfs2/btree.c"]}],"references":["https://git.kernel.org/stable/c/2b78e9df10fb7f4e9d3d7a18417dd72fbbc1dfd0","https://git.kernel.org/stable/c/1d94dbdfbb64cc48d10dec65cc3c4fbf2497b343","https://git.kernel.org/stable/c/24bf40740a3da6b4056721da34997ae6938f3da1","https://git.kernel.org/stable/c/73d23ecf234b7a6d47fb883f2dabe10e3230b31d","https://git.kernel.org/stable/c/f68523e0f26faade18833fbef577a4295d8e2c94","https://git.kernel.org/stable/c/21839b6fbc3c41b3e374ecbdb0cabbbb2c53cf34","https://git.kernel.org/stable/c/db73500d3f0e558eb642aae1d4782e7726b4a03f","https://git.kernel.org/stable/c/3644554d308ddf2669e459a1551a7edf60b2d62b","https://git.kernel.org/stable/c/9403001ad65ae4f4c5de368bdda3a0636b51d51a","https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html","https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-355557.html"],"weaknesses":[],"ingestedAt":"2026-10-29T20:07:56.516Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/47xxx/CVE-2024-47699.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-47699","state":"PUBLISHED","datePublished":"2024-10-21T11:53:35.962Z","dateUpdated":"2026-10-15T00:51:46.202Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-09-30T16:00:12.944Z"},"containers":{"cna":{"title":"nilfs2: fix potential null-ptr-deref in nilfs_btree_insert()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix potential null-ptr-deref in nilfs_btree_insert()\n\nPatch series \"nilfs2: fix potential issues with empty b-tree nodes\".\n\nThis series addresses three potential issues with empty b-tree nodes that\ncan occur with corrupted filesystem images, including one recently\ndiscovered by syzbot.\n\n\nThis patch (of 3):\n\nIf a b-tree is broken on the device, and the b-tree height is greater than\n2 (the level of the root node is greater than 1) even if the number of\nchild nodes of the b-tree root is 0, a NULL pointer dereference occurs in\nnilfs_btree_prepare_insert(), which is called from nilfs_btree_insert().\n\nThis is because, when the number of child nodes of the b-tree root is 0,\nnilfs_btree_do_lookup() does not set the block buffer head in any of\npath[x].bp_bh, leaving it as the initial value of NULL, but if the level\nof the b-tree root node is greater than 1, nilfs_btree_get_nonroot_node(),\nwhich accesses the buffer memory of path[x].bp_bh, is called.\n\nFix this issue by adding a check to nilfs_btree_root_broken(), which\nperforms sanity checks when reading the root node from the device, to\ndetect this inconsistency.\n\nThanks to Lizhi Xu for trying to solve the bug and clarifying the cause\nearly on."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"17c76b0104e4a6513983777e1a17e0297a12b0c4","status":"affected","lessThan":"2b78e9df10fb7f4e9d3d7a18417dd72fbbc1dfd0","versionType":"git"},{"version":"17c76b0104e4a6513983777e1a17e0297a12b0c4","status":"affected","lessThan":"1d94dbdfbb64cc48d10dec65cc3c4fbf2497b343","versionType":"git"},{"version":"17c76b0104e4a6513983777e1a17e0297a12b0c4","status":"affected","lessThan":"24bf40740a3da6b4056721da34997ae6938f3da1","versionType":"git"},{"version":"17c76b0104e4a6513983777e1a17e0297a12b0c4","status":"affected","lessThan":"73d23ecf234b7a6d47fb883f2dabe10e3230b31d","versionType":"git"},{"version":"17c76b0104e4a6513983777e1a17e0297a12b0c4","status":"affected","lessThan":"f68523e0f26faade18833fbef577a4295d8e2c94","versionType":"git"},{"version":"17c76b0104e4a6513983777e1a17e0297a12b0c4","status":"affected","lessThan":"21839b6fbc3c41b3e374ecbdb0cabbbb2c53cf34","versionType":"git"},{"version":"17c76b0104e4a6513983777e1a17e0297a12b0c4","status":"affected","lessThan":"db73500d3f0e558eb642aae1d4782e7726b4a03f","versionType":"git"},{"version":"17c76b0104e4a6513983777e1a17e0297a12b0c4","status":"affected","lessThan":"3644554d308ddf2669e459a1551a7edf60b2d62b","versionType":"git"},{"version":"17c76b0104e4a6513983777e1a17e0297a12b0c4","status":"affected","lessThan":"9403001ad65ae4f4c5de368bdda3a0636b51d51a","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nilfs2/btree.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.30","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.30","versionType":"semver"},{"version":"4.19.323","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.285","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.227","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.168","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.113","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.54","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.10.13","status":"unaffected","lessThanOrEqual":"6.10.*","versionType":"semver"},{"version":"6.11.2","status":"unaffected","lessThanOrEqual":"6.11.*","versionType":"semver"},{"version":"6.12","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nilfs2/btree.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/2b78e9df10fb7f4e9d3d7a18417dd72fbbc1dfd0"},{"url":"https://git.kernel.org/stable/c/1d94dbdfbb64cc48d10dec65cc3c4fbf2497b343"},{"url":"https://git.kernel.org/stable/c/24bf40740a3da6b4056721da34997ae6938f3da1"},{"url":"https://git.kernel.org/stable/c/73d23ecf234b7a6d47fb883f2dabe10e3230b31d"},{"url":"https://git.kernel.org/stable/c/f68523e0f26faade18833fbef577a4295d8e2c94"},{"url":"https://git.kernel.org/stable/c/21839b6fbc3c41b3e374ecbdb0cabbbb2c53cf34"},{"url":"https://git.kernel.org/stable/c/db73500d3f0e558eb642aae1d4782e7726b4a03f"},{"url":"https://git.kernel.org/stable/c/3644554d308ddf2669e459a1551a7edf60b2d62b"},{"url":"https://git.kernel.org/stable/c/9403001ad65ae4f4c5de368bdda3a0636b51d51a"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-05-11T20:39:04.642Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.30","versionEndExcluding":"4.19.323"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.30","versionEndExcluding":"5.4.285"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.30","versionEndExcluding":"5.10.227"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.30","versionEndExcluding":"5.15.168"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.30","versionEndExcluding":"6.1.113"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.30","versionEndExcluding":"6.6.54"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.30","versionEndExcluding":"6.10.13"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.30","versionEndExcluding":"6.11.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.30","versionEndExcluding":"6.12"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-47699","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-10-21T13:04:48.707894Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-21T13:14:13.842Z"}},{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"},{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T22:21:05.866Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"V1.1.1","versionType":"custom"}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-355557.html"}],"providerMetadata":{"shortName":"siemens-SADP","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","dateUpdated":"2026-10-15T00:51:46.202Z"},"x_adpType":"supplier"}]}}}