233 lines
12 KiB
JSON
233 lines
12 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2024-39472",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2024-06-25T14:23:23.745Z",
|
|
"datePublished": "2024-07-05T06:42:03.495Z",
|
|
"dateUpdated": "2026-08-05T11:33:29.670Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T11:33:29.670Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix log recovery buffer allocation for the legacy h_size fixup\n\nCommit a70f9fe52daa (\"xfs: detect and handle invalid iclog size set by\nmkfs\") added a fixup for incorrect h_size values used for the initial\numount record in old xfsprogs versions. Later commit 0c771b99d6c9\n(\"xfs: clean up calculation of LR header blocks\") cleaned up the log\nreover buffer calculation, but stoped using the fixed up h_size value\nto size the log recovery buffer, which can lead to an out of bounds\naccess when the incorrect h_size does not come from the old mkfs\ntool, but a fuzzer.\n\nFix this by open coding xlog_logrec_hblks and taking the fixed h_size\ninto account for this calculation."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H",
|
|
"baseScore": 7.3,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The bug is reached only through XFS log recovery at mount time on a locally attached block device or image file; no network or remote-peer data reaches this code. Delivery via removable media still requires the image to be mounted on the local system.\nAC:L - Every input is attacker-chosen on-disk data — `sb_logsunit` (raises `m_logbsize` to 256K with no mount option needed), and `h_size`/`h_len`/`h_num_logops`/`h_version` in the tail log record — so the undersized `hbp` and the ~224 KB overread happen deterministically on every mount, with no race and no memory layout to groom.\nPR:N - The attacker needs no account or privilege on the target; they only need to hand over a crafted XFS image (USB stick, disk image, exported LUN) that is then mounted by the victim or by an automounter such as udisks2 on a desktop or kiosk. Equivalently, an unprivileged local user on an automount-enabled system reaches it with PR:L/UI:N, which yields the identical exploitability score.\nUI:R - A user or automount service must mount the malicious filesystem with a dirty log so that `xlog_do_recovery_pass()` runs; the attacker cannot initiate the mount themselves.\nS:U - The out-of-bounds access and its consequences stay inside the kernel's own security authority — no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - `xlog_cksum()` and `xlog_unpack_data()` read at 32 KB strides up to ~224 KB past a 512-byte `kvzalloc()` slab object, and on a non-CRC (v4) image the harvested heap dwords are copied into the replayed log data and committed to the filesystem, giving the attacker a large, readable kernel heap disclosure.\nI:L - There is no out-of-bounds write — `dbp` is sized from the fixed-up `h_size` and `bblks <= BTOBB(h_size)` — but the out-of-bounds kernel heap dwords are spliced into the log record data by `xlog_unpack_data()` and replayed into on-disk metadata, producing limited, attacker-uncontrolled modification of filesystem data.\nA:H - Reading roughly 224 KB beyond a 512-byte slab allocation readily crosses into unmapped memory, producing a page fault/oops (or a KASAN slab-out-of-bounds panic) during mount, taking down the system."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/xfs/xfs_log_recover.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "0c771b99d6c9a0552fea5cc43669b726dad8f659",
|
|
"lessThan": "f754591b17d0ee91c2b45fe9509d0cdc420527cb",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "0c771b99d6c9a0552fea5cc43669b726dad8f659",
|
|
"lessThan": "57835c0e7152e36b03875dd6c56dfeed685c1b1f",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "0c771b99d6c9a0552fea5cc43669b726dad8f659",
|
|
"lessThan": "c2389c074973aa94e34992e7f66dac0de37595b5",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "0c771b99d6c9a0552fea5cc43669b726dad8f659",
|
|
"lessThan": "45cf976008ddef4a9c9a30310c9b4fb2a9a6602a",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/xfs/xfs_log_recover.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "5.10",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "5.10",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.165",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.105",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.46",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.10",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.10",
|
|
"versionEndExcluding": "5.15.165"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.10",
|
|
"versionEndExcluding": "6.1.105"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.10",
|
|
"versionEndExcluding": "6.6.46"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.10",
|
|
"versionEndExcluding": "6.10"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/f754591b17d0ee91c2b45fe9509d0cdc420527cb"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/57835c0e7152e36b03875dd6c56dfeed685c1b1f"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/c2389c074973aa94e34992e7f66dac0de37595b5"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/45cf976008ddef4a9c9a30310c9b4fb2a9a6602a"
|
|
}
|
|
],
|
|
"title": "xfs: fix log recovery buffer allocation for the legacy h_size fixup",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"title": "CVE Program Container",
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/45cf976008ddef4a9c9a30310c9b4fb2a9a6602a",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
|
|
}
|
|
],
|
|
"providerMetadata": {
|
|
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
|
"shortName": "CVE",
|
|
"dateUpdated": "2025-11-03T21:56:05.270Z"
|
|
}
|
|
},
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"id": "CVE-2024-39472",
|
|
"role": "CISA Coordinator",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "partial"
|
|
}
|
|
],
|
|
"version": "2.0.3",
|
|
"timestamp": "2024-09-10T17:07:45.783551Z"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2024-09-11T17:34:41.426Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |