CVE-2024-46688 erofs: fix out-of-bound access when z_erofs_gbuf_growsize() partially fails
A local attacker can trigger a null pointer dereference or out-of-bounds access in the EROFS filesystem, causing a system crash.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-46688?
CVE-2024-46688 is a medium-severity vulnerability in Linux kernel, published on 13 Sep 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
erofs: fix out-of-bound access when z_erofs_gbuf_growsize() partially fails
If z_erofs_gbuf_growsize() partially fails on a global buffer due to memory allocation failure or fault injection (as reported by syzbot [1]), new pages need to be freed by comparing to the existing pages to avoid memory leaks.
However, the old gbuf->pages[] array may not be large enough, which can lead to null-ptr-deref or out-of-bound access.
Fix this by checking against gbuf->nrpages in advance.
[1] https://lore.kernel.org/r/[email protected]
Weakness: CWE-787
Which versions are affected by CVE-2024-46688?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-46688?
Apply the vendor's patch.
Is CVE-2024-46688 being exploited?
There is no known exploitation of CVE-2024-46688 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-46688, DEBIAN-CVE-2024-46688, GHSA-hrvw-rfgx-8g4m, UBUNTU-CVE-2024-46688.