329 lines
19 KiB
JSON
329 lines
19 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2024-39467",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2024-06-25T14:23:23.744Z",
|
|
"datePublished": "2024-06-25T14:25:05.609Z",
|
|
"dateUpdated": "2026-08-05T11:33:25.374Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T11:33:25.374Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode()\n\nsyzbot reports a kernel bug as below:\n\nF2FS-fs (loop0): Mounted with checkpoint version = 48b305e4\n==================================================================\nBUG: KASAN: slab-out-of-bounds in f2fs_test_bit fs/f2fs/f2fs.h:2933 [inline]\nBUG: KASAN: slab-out-of-bounds in current_nat_addr fs/f2fs/node.h:213 [inline]\nBUG: KASAN: slab-out-of-bounds in f2fs_get_node_info+0xece/0x1200 fs/f2fs/node.c:600\nRead of size 1 at addr ffff88807a58c76c by task syz-executor280/5076\n\nCPU: 1 PID: 5076 Comm: syz-executor280 Not tainted 6.9.0-rc5-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114\n print_address_description mm/kasan/report.c:377 [inline]\n print_report+0x169/0x550 mm/kasan/report.c:488\n kasan_report+0x143/0x180 mm/kasan/report.c:601\n f2fs_test_bit fs/f2fs/f2fs.h:2933 [inline]\n current_nat_addr fs/f2fs/node.h:213 [inline]\n f2fs_get_node_info+0xece/0x1200 fs/f2fs/node.c:600\n f2fs_xattr_fiemap fs/f2fs/data.c:1848 [inline]\n f2fs_fiemap+0x55d/0x1ee0 fs/f2fs/data.c:1925\n ioctl_fiemap fs/ioctl.c:220 [inline]\n do_vfs_ioctl+0x1c07/0x2e50 fs/ioctl.c:838\n __do_sys_ioctl fs/ioctl.c:902 [inline]\n __se_sys_ioctl+0x81/0x170 fs/ioctl.c:890\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nThe root cause is we missed to do sanity check on i_xattr_nid during\nf2fs_iget(), so that in fiemap() path, current_nat_addr() will access\nnat_bitmap w/ offset from invalid i_xattr_nid, result in triggering\nkasan bug report, fix it."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The vulnerable code is reached only through a locally attached/mounted crafted f2fs image, with the trigger being a local `ioctl(FS_IOC_FIEMAP, FIEMAP_FLAG_XATTR)` syscall or mount-time roll-forward recovery. No network or remote-peer data path exists into fs/f2fs/inode.c or the NAT lookup code.\nAC:L - The attacker fully controls every input — the on-disk `i_xattr_nid`, the checkpoint's NAT bitmap size, and the NAT/SSA/SIT block layout — so the out-of-range `NAT_BLOCK_OFFSET(nid)` deterministically indexes past `nm_i->nat_bitmap` on the first attempt. There is no race, no dependence on uncontrollable memory layout, and no non-default kernel config (fiemap and roll-forward recovery are both default-enabled).\nPR:L - Once the image is mounted, any unprivileged user can trigger the out-of-bounds access with a plain `FS_IOC_FIEMAP` ioctl — there is no capability check anywhere on the path from `do_vfs_ioctl` through `f2fs_fiemap` to `current_nat_addr`. On Android (vold auto-mounts f2fs portable/adoptable storage) and desktop/kiosk systems (udisks2/polkit), an unprivileged console user gets the attacker's f2fs image mounted without root.\nUI:N - The attacker supplies their own crafted image and issues the fiemap ioctl themselves; removable-media auto-mount by udisks2/vold happens without any deliberate victim action. The recovery-path variant likewise fires automatically during the mount the attacker caused.\nS:U - The out-of-bounds read and the bit-flip write both stay inside the kernel's own address space and security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a slab out-of-bounds read at an offset the attacker chooses byte-by-byte up to ~1.18 MB past a small `kmemdup`'d `nat_bitmap`, so it is not a strictly bounded few-byte read. The bit read back selects which NAT block is parsed, and the resulting `ni.blk_addr` is returned to userspace as the fiemap extent's physical address, turning it into a repeatable oracle that discloses adjacent heap contents — kernel pointers and other slab objects — defeating KASLR.\nI:H - Via `f2fs_recover_xattr_data()` the bogus nid reaches `set_node_addr()`, which dirties a NAT set keyed on the out-of-range block offset; the next checkpoint then executes `f2fs_change_bit(block_off, nm_i->nat_bitmap)` in `set_to_next_nat()` and `__set_bit_le(nat_index, nm_i->empty_nat_bits)` in `__update_nat_bits()` — out-of-bounds heap writes at an attacker-chosen offset. A controlled single-bit flip into a groomed adjacent slab object (pointer, refcount, or credential/permission field) is a well-established privilege-escalation primitive.\nA:H - The reported symptom is a KASAN slab-out-of-bounds report, which panics on `panic_on_warn`/hardened Android and cloud kernels; on non-KASAN kernels the read can walk into unmapped memory and oops. The out-of-bounds bit flips additionally corrupt the NAT bitmap and neighbouring heap objects, and `f2fs_bug_on`/`f2fs_handle_error` paths in the checkpoint flush stop the filesystem, so the crash is reliably re-triggerable."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/f2fs/inode.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4",
|
|
"lessThan": "c559a8d840562fbfce9f318448dda2f7d3e6d8e8",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4",
|
|
"lessThan": "75c87e2ac6149abf44bdde0dd6d541763ddb0dff",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4",
|
|
"lessThan": "1640dcf383cdba52be8b28d2a1a2aa7ef7a30c98",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4",
|
|
"lessThan": "8c8aa473fe6eb46a4bf99f3ea2dbe52bf0c1a1f0",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4",
|
|
"lessThan": "be0155202e431f3007778568a72432c68f8946ba",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4",
|
|
"lessThan": "68e3cd4ecb8603936cccdc338929130045df2e57",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "98e4da8ca301e062d79ae168c67e56f3c3de3ce4",
|
|
"lessThan": "20faaf30e55522bba2b56d9c46689233205d7717",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/f2fs/inode.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "3.8",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "3.8",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.4.278",
|
|
"lessThanOrEqual": "5.4.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.10.219",
|
|
"lessThanOrEqual": "5.10.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.161",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.94",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.34",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.9.5",
|
|
"lessThanOrEqual": "6.9.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.10",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.8",
|
|
"versionEndExcluding": "5.4.278"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.8",
|
|
"versionEndExcluding": "5.10.219"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.8",
|
|
"versionEndExcluding": "5.15.161"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.8",
|
|
"versionEndExcluding": "6.1.94"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.8",
|
|
"versionEndExcluding": "6.6.34"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.8",
|
|
"versionEndExcluding": "6.9.5"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.8",
|
|
"versionEndExcluding": "6.10"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/c559a8d840562fbfce9f318448dda2f7d3e6d8e8"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/75c87e2ac6149abf44bdde0dd6d541763ddb0dff"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/1640dcf383cdba52be8b28d2a1a2aa7ef7a30c98"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/8c8aa473fe6eb46a4bf99f3ea2dbe52bf0c1a1f0"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/be0155202e431f3007778568a72432c68f8946ba"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/68e3cd4ecb8603936cccdc338929130045df2e57"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/20faaf30e55522bba2b56d9c46689233205d7717"
|
|
}
|
|
],
|
|
"title": "f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode()",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"timestamp": "2024-06-25T20:07:46.450278Z",
|
|
"id": "CVE-2024-39467",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "partial"
|
|
}
|
|
],
|
|
"role": "CISA Coordinator",
|
|
"version": "2.0.3"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2024-07-30T14:19:38.256Z"
|
|
}
|
|
},
|
|
{
|
|
"providerMetadata": {
|
|
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
|
"shortName": "CVE",
|
|
"dateUpdated": "2024-08-02T04:26:15.173Z"
|
|
},
|
|
"title": "CVE Program Container",
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/c559a8d840562fbfce9f318448dda2f7d3e6d8e8",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/75c87e2ac6149abf44bdde0dd6d541763ddb0dff",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/1640dcf383cdba52be8b28d2a1a2aa7ef7a30c98",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/8c8aa473fe6eb46a4bf99f3ea2dbe52bf0c1a1f0",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/be0155202e431f3007778568a72432c68f8946ba",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/68e3cd4ecb8603936cccdc338929130045df2e57",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/20faaf30e55522bba2b56d9c46689233205d7717",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
} |