Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-39467— f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于sanity_check_inode函数对 i_xattr_nid 没有进行健全性检查。

CVSS 7.8 · High EPSS 0.24% · P14

Possible ATT&CK Techniques 1 AI

T1499.001 · OS Exhaustion Flood

Affected Version Matrix 16

VendorProduct Version RangeStatus
Linux Linux 98e4da8ca301e062d79ae168c67e56f3c3de3ce4< c559a8d840562fbfce9f318448dda2f7d3e6d8e8 affected
98e4da8ca301e062d79ae168c67e56f3c3de3ce4< 75c87e2ac6149abf44bdde0dd6d541763ddb0dff affected
98e4da8ca301e062d79ae168c67e56f3c3de3ce4< 1640dcf383cdba52be8b28d2a1a2aa7ef7a30c98 affected
98e4da8ca301e062d79ae168c67e56f3c3de3ce4< 8c8aa473fe6eb46a4bf99f3ea2dbe52bf0c1a1f0 affected
98e4da8ca301e062d79ae168c67e56f3c3de3ce4< be0155202e431f3007778568a72432c68f8946ba affected
98e4da8ca301e062d79ae168c67e56f3c3de3ce4< 68e3cd4ecb8603936cccdc338929130045df2e57 affected
98e4da8ca301e062d79ae168c67e56f3c3de3ce4< 20faaf30e55522bba2b56d9c46689233205d7717 affected
3.8 affected
… +8 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-39467

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode() syzbot reports a kernel bug as below: F2FS-fs (loop0): Mounted with checkpoint version = 48b305e4 ================================================================== BUG: KASAN: slab-out-of-bounds in f2fs_test_bit fs/f2fs/f2fs.h:2933 [inline] BUG: KASAN: slab-out-of-bounds in current_nat_addr fs/f2fs/node.h:213 [inline] BUG: KASAN: slab-out-of-bounds in f2fs_get_node_info+0xece/0x1200 fs/f2fs/node.c:600 Read of size 1 at addr ffff88807a58c76c by task syz-executor280/5076 CPU: 1 PID: 5076 Comm: syz-executor280 Not tainted 6.9.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 f2fs_test_bit fs/f2fs/f2fs.h:2933 [inline] current_nat_addr fs/f2fs/node.h:213 [inline] f2fs_get_node_info+0xece/0x1200 fs/f2fs/node.c:600 f2fs_xattr_fiemap fs/f2fs/data.c:1848 [inline] f2fs_fiemap+0x55d/0x1ee0 fs/f2fs/data.c:1925 ioctl_fiemap fs/ioctl.c:220 [inline] do_vfs_ioctl+0x1c07/0x2e50 fs/ioctl.c:838 __do_sys_ioctl fs/ioctl.c:902 [inline] __se_sys_ioctl+0x81/0x170 fs/ioctl.c:890 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f The root cause is we missed to do sanity check on i_xattr_nid during f2fs_iget(), so that in fiemap() path, current_nat_addr() will access nat_bitmap w/ offset from invalid i_xattr_nid, result in triggering kasan bug report, fix it.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于sanity_check_inode函数对 i_xattr_nid 没有进行健全性检查。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 ~ c559a8d840562fbfce9f318448dda2f7d3e6d8e8 -
Linux Linux 3.8 -

II. Public POCs for CVE-2024-39467

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-39467

请登录查看更多情报信息。

Other References for CVE-2024-39467 (7)

Same Patch Batch · Linux · 2024-06-25 · 24 CVEs total

CVE-2024-39293 9.8 CRITICAL Revert "xsk: Support redirect to any socket bound to the same umem"
CVE-2024-39471 7.8 HIGH drm/amdgpu: add error handle to avoid out-of-bounds
CVE-2024-37354 7.8 HIGH btrfs: fix crash on racing fsync and size-extending write into prealloc
CVE-2024-37078 7.8 HIGH nilfs2: fix potential kernel bug due to lack of writeback flag waiting
CVE-2024-38306 7.8 HIGH btrfs: protect folio::private when attaching extent buffer folios
CVE-2024-38385 7.8 HIGH genirq/irqdesc: Prevent use-after-free in irq_find_at_or_after()
CVE-2024-39463 7.8 HIGH 9p: add missing locking around taking dentry fid list
CVE-2024-39468 7.5 HIGH smb: client: fix deadlock in smb2_find_smb_tcon()
CVE-2024-39469 7.1 HIGH nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors
CVE-2024-39301 net/9p: fix uninit-value in p9_client_rpc()
CVE-2024-39470 eventfs: Fix a possible null pointer dereference in eventfs_find_events()
CVE-2024-39466 thermal/drivers/qcom/lmh: Check for SCM availability at probe
CVE-2024-39464 media: v4l: async: Fix notifier list entry init
CVE-2024-39465 media: mgb4: Fix double debugfs remove
CVE-2024-39462 clk: bcm: dvp: Assign ->num before accessing ->hws
CVE-2024-39461 clk: bcm: rpi: Assign ->num before accessing ->hws
CVE-2024-39371 io_uring: check for non-NULL file pointer in io_file_can_poll()
CVE-2021-4440 x86/xen: Drop USERGS_SYSRET64 paravirt call
CVE-2024-39298 mm/memory-failure: fix handling of dissolved but not taken off from buddy pages
CVE-2024-39296 bonding: fix oops during rmmod

Showing top 20 of 24 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2024-39467

No comments yet

Leave a comment