Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2024-56619

nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry() Syzbot reported that when searching for records in a directory where the inode's i_size is corrupted and has a large value, memory access outside the folio/page range may occur, or a use-after-free bug may be detected if KASAN is enabled. This is because nilfs_last_byte(), which is called by nilfs_find_entry() and others to calculate the number of valid bytes of directory data in a page from i_size and the page index, loses the upper 32 bits of the 64-bit size information due to an inappropriate type of local variable to which the i_size value is assigned. This caused a large byte offset value due to underflow in the end address calculation in the calling nilfs_find_entry(), resulting in memory access that exceeds the folio/page size. Fix this issue by changing the type of the local variable causing the bit loss from "unsigned int" to "u64". The return value of nilfs_last_byte() is also of type "unsigned int", but it is truncated so as not to exceed PAGE_SIZE and no bit loss occurs, so no change is required.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 2ba466d74ed74f073257f86e61519cb8f8f46184 to < 09d6d05579fd46e61abf6e457bb100ff11f3a9d3affected
  • 2ba466d74ed74f073257f86e61519cb8f8f46184 to < e3732102a9d638d8627d14fdf7b208462f0520e0affected
  • 2ba466d74ed74f073257f86e61519cb8f8f46184 to < 48eb6e7404948032bbe811c5affbe39f6b316951affected
  • 2ba466d74ed74f073257f86e61519cb8f8f46184 to < 5af8366625182f01f6d8465c9a3210574673af57affected
  • 2ba466d74ed74f073257f86e61519cb8f8f46184 to < c3afea07477baccdbdec4483f8d5e59d42a3f67faffected
  • 2ba466d74ed74f073257f86e61519cb8f8f46184 to < 31f7b57a77d4c82a34ddcb6ff35b5aa577ef153eaffected
  • 2ba466d74ed74f073257f86e61519cb8f8f46184 to < 985ebec4ab0a28bb5910c3b1481a40fbf7f9e61daffected

Linux Linux

Default version status: affected

  • 2.6.30affected
  • 0 to < 2.6.30unaffected
  • 5.4.287 to ≤ 5.4.*unaffected
  • 5.10.231 to ≤ 5.10.*unaffected
  • 5.15.174 to ≤ 5.15.*unaffected
  • 6.1.120 to ≤ 6.1.*unaffected
  • 6.6.66 to ≤ 6.6.*unaffected
  • 6.12.5 to ≤ 6.12.*unaffected
  • 6.13 to ≤ *unaffected

References