Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-42295— nilfs2: handle inconsistent state in nilfs_btnode_create_block()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于nilfs2在nilfs_btnode_create_block函数中存在状态不一致问题。

AI Predicted 5.5 Difficulty: Moderate EPSS 0.23% · P13

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux a60be987d45dd510aeb54389526f9957cfab106c< 19cce46238ffe3546e44b9c74057103ff8b24c62 affected
a60be987d45dd510aeb54389526f9957cfab106c< 02b87e6334a38c65eef49848d3f1ac422f0b2a44 affected
a60be987d45dd510aeb54389526f9957cfab106c< 5f0a6800b8aec1b453c7fe4c44fcaac5ffe9d52e affected
a60be987d45dd510aeb54389526f9957cfab106c< e34191cce3ee63dfa5fb241904aaf2a042d5b6d8 affected
a60be987d45dd510aeb54389526f9957cfab106c< 012be828a118bf496e666ef1fc47fc0e7358ada2 affected
a60be987d45dd510aeb54389526f9957cfab106c< be56dfc9be0604291267c07b0e27a69a6bda4899 affected
a60be987d45dd510aeb54389526f9957cfab106c< 366c3f688dd0288cbe38af1d3a886b5c62372e4a affected
a60be987d45dd510aeb54389526f9957cfab106c< 4811f7af6090e8f5a398fbdd766f903ef6c0d787 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-42295

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
nilfs2: handle inconsistent state in nilfs_btnode_create_block()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: nilfs2: handle inconsistent state in nilfs_btnode_create_block() Syzbot reported that a buffer state inconsistency was detected in nilfs_btnode_create_block(), triggering a kernel bug. It is not appropriate to treat this inconsistency as a bug; it can occur if the argument block address (the buffer index of the newly created block) is a virtual block number and has been reallocated due to corruption of the bitmap used to manage its allocation state. So, modify nilfs_btnode_create_block() and its callers to treat it as a possible filesystem error, rather than triggering a kernel bug.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于nilfs2在nilfs_btnode_create_block函数中存在状态不一致问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux a60be987d45dd510aeb54389526f9957cfab106c ~ 19cce46238ffe3546e44b9c74057103ff8b24c62 -
Linux Linux 2.6.30 -

II. Public POCs for CVE-2024-42295

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-42295

请登录查看更多情报信息。

Patches & Fixes for CVE-2024-42295 (1)

Other References for CVE-2024-42295 (7)

Same Patch Batch · Linux · 2024-08-17 · 109 CVEs total

CVE-2024-42285 9.8 CRITICAL RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
CVE-2024-42284 9.1 CRITICAL tipc: Return non-zero value from tipc_udp_addr2str() on error
CVE-2024-43847 8.8 HIGH wifi: ath12k: fix invalid memory access while processing fragmented packets
CVE-2024-43848 8.8 HIGH wifi: mac80211: fix TTLM teardown work
CVE-2024-42287 8.8 HIGH scsi: qla2xxx: Complete command early within lock
CVE-2024-42318 8.8 HIGH landlock: Don't lose track of restrictions on cred_transfer
CVE-2024-42296 7.8 HIGH f2fs: fix return value of f2fs_convert_inline_inode()
CVE-2024-42288 7.8 HIGH scsi: qla2xxx: Fix for possible memory corruption
CVE-2024-43845 7.8 HIGH udf: Fix bogus checksum computation in udf_rename()
CVE-2024-43830 7.8 HIGH leds: trigger: Unregister sysfs attributes before calling deactivate()
CVE-2024-42293 7.8 HIGH arm64: mm: Fix lockless walks with static and dynamic page-table folding
CVE-2024-43832 7.8 HIGH s390/uv: Don't call folio_wait_writeback() without a folio reference
CVE-2024-42301 7.8 HIGH dev/parport: fix the array out-of-bounds risk
CVE-2024-42311 7.8 HIGH hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
CVE-2024-42313 7.8 HIGH media: venus: fix use after free in vdec_close
CVE-2024-42306 7.8 HIGH udf: Avoid using corrupted block bitmap buffer
CVE-2024-42304 7.8 HIGH ext4: make sure the first directory block is not a hole
CVE-2024-42314 7.8 HIGH btrfs: fix extent map use-after-free when adding pages to compressed bio
CVE-2024-42299 7.8 HIGH fs/ntfs3: Update log->page_{mask,bits} if log->page_size changed
CVE-2024-42297 7.8 HIGH f2fs: fix to don't dirty inode for readonly filesystem

Showing top 20 of 109 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2024-42295

No comments yet

Leave a comment