CVE-2024-49900 jfs: Fix uninit-value access of new_ea in ea_buffer
An uninitialized memory access in the JFS filesystem allows local attackers to read sensitive kernel memory contents.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-49900?
CVE-2024-49900 is a high-severity vulnerability in Linux kernel, published on 21 Oct 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
jfs: Fix uninit-value access of new_ea in ea_buffer
syzbot reports that lzo1x_1_do_compress is using uninit-value:
===================================================== BUG: KMSAN: uninit-value in lzo1x_1_do_compress+0x19f9/0x2510 lib/lzo/lzo1x_compress.c:178
...
Uninit was stored to memory at: ea_put fs/jfs/xattr.c:639 [inline]
...
Local variable ea_buf created at: __jfs_setxattr+0x5d/0x1ae0 fs/jfs/xattr.c:662 __jfs_xattr_set+0xe6/0x1f0 fs/jfs/xattr.c:934
=====================================================
The reason is ea_buf->new_ea is not initialized properly.
Fix this by using memset to empty its content at the beginning in ea_get().
Weakness: CWE-908
Which versions are affected by CVE-2024-49900?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-49900?
Apply the vendor's patch.
Is CVE-2024-49900 being exploited?
There is no known exploitation of CVE-2024-49900 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-51485, BELL-CVE-2024-49900, DEBIAN-CVE-2024-49900, GHSA-ppw5-g3vp-9xx2, UBUNTU-CVE-2024-49900.