CVE-2024-26981 nilfs2: fix OOB in nilfs_set_de_type
An out-of-bounds read in the nilfs2 filesystem allows attackers to cause a denial of service or potentially execute code via crafted filesystem images.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-26981?
CVE-2024-26981 is a high-severity memory corruption vulnerability in Debian Debian Linux, published on 1 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix OOB in nilfs_set_de_type
The size of the nilfs_type_by_mode array in the fs/nilfs2/dir.c file is defined as "S_IFMT >> S_SHIFT", but the nilfs_set_de_type() function, which uses this array, specifies the index to read from the array in the same way as "(mode & S_IFMT) >> S_SHIFT".
static void nilfs_set_de_type(struct nilfs_dir_entry *de, struct inode *inode) { umode_t mode = inode->i_mode;
de->file_type = nilfs_type_by_mode[(mode & S_IFMT)>>S_SHIFT]; // oob }
However, when the index is determined this way, an out-of-bounds (OOB) error occurs by referring to an index that is 1 larger than the array size when the condition "mode & S_IFMT == S_IFMT" is satisfied. Therefore, a patch to resize the nilfs_type_by_mode array should be applied to prevent OOB errors.
Weakness: CWE-129
Which versions are affected by CVE-2024-26981?
It affects 2 products.
Products include Debian Debian Linux, Linux kernel.
How do I fix CVE-2024-26981?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-26981 being exploited?
There is no known exploitation of CVE-2024-26981 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as BELL-CVE-2024-26981, DEBIAN-CVE-2024-26981, GHSA-h8c3-hrx9-cf8g, UBUNTU-CVE-2024-26981.