CVE-2024-44939 jfs: fix null ptr deref in dtInsertEntry
A null pointer dereference in the Linux kernel JFS filesystem allows local attackers to cause a system crash.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-44939?
CVE-2024-44939 is a high-severity vulnerability in Linux kernel, published on 26 Aug 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
jfs: fix null ptr deref in dtInsertEntry
[syzbot reported] general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 PID: 5061 Comm: syz-executor404 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 RIP: 0010:dtInsertEntry+0xd0c/0x1780 fs/jfs/jfs_dtree.c:3713 ... [Analyze] In dtInsertEntry(), when the pointer h has the same value as p, after writing name in UniStrncpy_to_le(), p->header.flag will be cleared. This will cause the previously true judgment "p->header.flag & BT-LEAF" to change to no after writing the name operation, this leads to entering an incorrect branch and accessing the uninitialized object ih when judging this condition for the second time.
[Fix] After got the page, check freelist first, if freelist == 0 then exit dtInsert() and return -EINVAL.
Weakness: CWE-476
Which versions are affected by CVE-2024-44939?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-44939?
Apply the vendor's patch.
Is CVE-2024-44939 being exploited?
There is no known exploitation of CVE-2024-44939 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-49075, BELL-CVE-2024-44939, DEBIAN-CVE-2024-44939, GHSA-27qw-rmpj-379q, ROOT-OS-DEBIAN-11-CVE-2024-44939, ROOT-OS-UBUNTU-2204-CVE-2024-44939 and 1 more.