CVE-2024-42105
Vulnerability from cvelistv5
Published
2024-07-30 07:46
Modified
2024-12-19 09:12
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix inode number range checks Patch series "nilfs2: fix potential issues related to reserved inodes". This series fixes one use-after-free issue reported by syzbot, caused by nilfs2's internal inode being exposed in the namespace on a corrupted filesystem, and a couple of flaws that cause problems if the starting number of non-reserved inodes written in the on-disk super block is intentionally (or corruptly) changed from its default value. This patch (of 3): In the current implementation of nilfs2, "nilfs->ns_first_ino", which gives the first non-reserved inode number, is read from the superblock, but its lower limit is not checked. As a result, if a number that overlaps with the inode number range of reserved inodes such as the root directory or metadata files is set in the super block parameter, the inode number test macros (NILFS_MDT_INODE and NILFS_VALID_INODE) will not function properly. In addition, these test macros use left bit-shift calculations using with the inode number as the shift count via the BIT macro, but the result of a shift calculation that exceeds the bit width of an integer is undefined in the C specification, so if "ns_first_ino" is set to a large value other than the default value NILFS_USER_INO (=11), the macros may potentially malfunction depending on the environment. Fix these issues by checking the lower bound of "nilfs->ns_first_ino" and by preventing bit shifts equal to or greater than the NILFS_USER_INO constant in the inode number test macros. Also, change the type of "ns_first_ino" from signed integer to unsigned integer to avoid the need for type casting in comparisons such as the lower bound check introduced this time.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/08cab183a624ba71603f3754643ae11cab34dbc4
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/1c91058425a01131ea30dda6cf43c67b17884d6a
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3be4dcc8d7bea52ea41f87aa4bbf959efe7a5987
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/57235c3c88bb430043728d0d02f44a4efe386476
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/731011ac6c37cbe97ece229fc6daa486276052c5
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9194f8ca57527958bee207919458e372d638d783
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e2fec219a36e0993642844be0f345513507031f4
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/fae1959d6ab2c52677b113935e36ab4e25df37ea
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/08cab183a624ba71603f3754643ae11cab34dbc4
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/1c91058425a01131ea30dda6cf43c67b17884d6a
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/3be4dcc8d7bea52ea41f87aa4bbf959efe7a5987
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/57235c3c88bb430043728d0d02f44a4efe386476
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/731011ac6c37cbe97ece229fc6daa486276052c5
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/9194f8ca57527958bee207919458e372d638d783
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/e2fec219a36e0993642844be0f345513507031f4
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/fae1959d6ab2c52677b113935e36ab4e25df37ea
Impacted products
Vendor Product Version
Linux Linux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:54:32.550Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/57235c3c88bb430043728d0d02f44a4efe386476"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/08cab183a624ba71603f3754643ae11cab34dbc4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/731011ac6c37cbe97ece229fc6daa486276052c5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3be4dcc8d7bea52ea41f87aa4bbf959efe7a5987"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/fae1959d6ab2c52677b113935e36ab4e25df37ea"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9194f8ca57527958bee207919458e372d638d783"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1c91058425a01131ea30dda6cf43c67b17884d6a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e2fec219a36e0993642844be0f345513507031f4"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42105",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:17:49.299547Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:32:45.818Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nilfs2/nilfs.h",
            "fs/nilfs2/the_nilfs.c",
            "fs/nilfs2/the_nilfs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "57235c3c88bb430043728d0d02f44a4efe386476",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "08cab183a624ba71603f3754643ae11cab34dbc4",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "731011ac6c37cbe97ece229fc6daa486276052c5",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "3be4dcc8d7bea52ea41f87aa4bbf959efe7a5987",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "fae1959d6ab2c52677b113935e36ab4e25df37ea",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "9194f8ca57527958bee207919458e372d638d783",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "1c91058425a01131ea30dda6cf43c67b17884d6a",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "e2fec219a36e0993642844be0f345513507031f4",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nilfs2/nilfs.h",
            "fs/nilfs2/the_nilfs.c",
            "fs/nilfs2/the_nilfs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.318",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.280",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.163",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.98",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix inode number range checks\n\nPatch series \"nilfs2: fix potential issues related to reserved inodes\".\n\nThis series fixes one use-after-free issue reported by syzbot, caused by\nnilfs2\u0027s internal inode being exposed in the namespace on a corrupted\nfilesystem, and a couple of flaws that cause problems if the starting\nnumber of non-reserved inodes written in the on-disk super block is\nintentionally (or corruptly) changed from its default value.  \n\n\nThis patch (of 3):\n\nIn the current implementation of nilfs2, \"nilfs-\u003ens_first_ino\", which\ngives the first non-reserved inode number, is read from the superblock,\nbut its lower limit is not checked.\n\nAs a result, if a number that overlaps with the inode number range of\nreserved inodes such as the root directory or metadata files is set in the\nsuper block parameter, the inode number test macros (NILFS_MDT_INODE and\nNILFS_VALID_INODE) will not function properly.\n\nIn addition, these test macros use left bit-shift calculations using with\nthe inode number as the shift count via the BIT macro, but the result of a\nshift calculation that exceeds the bit width of an integer is undefined in\nthe C specification, so if \"ns_first_ino\" is set to a large value other\nthan the default value NILFS_USER_INO (=11), the macros may potentially\nmalfunction depending on the environment.\n\nFix these issues by checking the lower bound of \"nilfs-\u003ens_first_ino\" and\nby preventing bit shifts equal to or greater than the NILFS_USER_INO\nconstant in the inode number test macros.\n\nAlso, change the type of \"ns_first_ino\" from signed integer to unsigned\ninteger to avoid the need for type casting in comparisons such as the\nlower bound check introduced this time."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T09:12:50.733Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/57235c3c88bb430043728d0d02f44a4efe386476"
        },
        {
          "url": "https://git.kernel.org/stable/c/08cab183a624ba71603f3754643ae11cab34dbc4"
        },
        {
          "url": "https://git.kernel.org/stable/c/731011ac6c37cbe97ece229fc6daa486276052c5"
        },
        {
          "url": "https://git.kernel.org/stable/c/3be4dcc8d7bea52ea41f87aa4bbf959efe7a5987"
        },
        {
          "url": "https://git.kernel.org/stable/c/fae1959d6ab2c52677b113935e36ab4e25df37ea"
        },
        {
          "url": "https://git.kernel.org/stable/c/9194f8ca57527958bee207919458e372d638d783"
        },
        {
          "url": "https://git.kernel.org/stable/c/1c91058425a01131ea30dda6cf43c67b17884d6a"
        },
        {
          "url": "https://git.kernel.org/stable/c/e2fec219a36e0993642844be0f345513507031f4"
        }
      ],
      "title": "nilfs2: fix inode number range checks",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42105",
    "datePublished": "2024-07-30T07:46:01.061Z",
    "dateReserved": "2024-07-29T15:50:41.175Z",
    "dateUpdated": "2024-12-19T09:12:50.733Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-42105\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-30T08:15:03.000\",\"lastModified\":\"2024-11-21T09:33:36.693\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnilfs2: fix inode number range checks\\n\\nPatch series \\\"nilfs2: fix potential issues related to reserved inodes\\\".\\n\\nThis series fixes one use-after-free issue reported by syzbot, caused by\\nnilfs2\u0027s internal inode being exposed in the namespace on a corrupted\\nfilesystem, and a couple of flaws that cause problems if the starting\\nnumber of non-reserved inodes written in the on-disk super block is\\nintentionally (or corruptly) changed from its default value.  \\n\\n\\nThis patch (of 3):\\n\\nIn the current implementation of nilfs2, \\\"nilfs-\u003ens_first_ino\\\", which\\ngives the first non-reserved inode number, is read from the superblock,\\nbut its lower limit is not checked.\\n\\nAs a result, if a number that overlaps with the inode number range of\\nreserved inodes such as the root directory or metadata files is set in the\\nsuper block parameter, the inode number test macros (NILFS_MDT_INODE and\\nNILFS_VALID_INODE) will not function properly.\\n\\nIn addition, these test macros use left bit-shift calculations using with\\nthe inode number as the shift count via the BIT macro, but the result of a\\nshift calculation that exceeds the bit width of an integer is undefined in\\nthe C specification, so if \\\"ns_first_ino\\\" is set to a large value other\\nthan the default value NILFS_USER_INO (=11), the macros may potentially\\nmalfunction depending on the environment.\\n\\nFix these issues by checking the lower bound of \\\"nilfs-\u003ens_first_ino\\\" and\\nby preventing bit shifts equal to or greater than the NILFS_USER_INO\\nconstant in the inode number test macros.\\n\\nAlso, change the type of \\\"ns_first_ino\\\" from signed integer to unsigned\\ninteger to avoid the need for type casting in comparisons such as the\\nlower bound check introduced this time.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nilfs2: corrige las comprobaciones del rango de n\u00fameros de inodos. Serie de parches \\\"nilfs2: soluciona posibles problemas relacionados con los inodos reservados\\\". Esta serie corrige un problema de use after free reportado por syzbot, causado por la exposici\u00f3n del inodo interno de nilfs2 en el espacio de nombres de un sistema de archivos corrupto, y un par de fallos que causan problemas si el n\u00famero inicial de inodos no reservados escritos en el -El superbloque de disco se cambia intencionalmente (o de forma corrupta) de su valor predeterminado. Este parche (de 3): En la implementaci\u00f3n actual de nilfs2, \\\"nilfs-\u0026gt;ns_first_ino\\\", que proporciona el primer n\u00famero de inodo no reservado, se lee del superbloque, pero no se verifica su l\u00edmite inferior. Como resultado, si en el par\u00e1metro de superbloque se establece un n\u00famero que se superpone con el rango de n\u00fameros de inodos reservados, como el directorio ra\u00edz o los archivos de metadatos, las macros de prueba de n\u00fameros de inodos (NILFS_MDT_INODE y NILFS_VALID_INODE) no funcionar\u00e1n correctamente. Adem\u00e1s, estas macros de prueba utilizan c\u00e1lculos de desplazamiento de bits a la izquierda utilizando el n\u00famero de inodo como recuento de desplazamiento a trav\u00e9s de la macro BIT, pero el resultado de un c\u00e1lculo de desplazamiento que excede el ancho de bits de un n\u00famero entero no est\u00e1 definido en la especificaci\u00f3n C, por lo que si \\\"ns_first_ino\\\" est\u00e1 configurado en un valor grande distinto del valor predeterminado NILFS_USER_INO (=11), es posible que las macros no funcionen correctamente seg\u00fan el entorno. Solucione estos problemas verificando el l\u00edmite inferior de \\\"nilfs-\u0026gt;ns_first_ino\\\" y evitando cambios de bits iguales o mayores que la constante NILFS_USER_INO en las macros de prueba de n\u00famero de inodo. Adem\u00e1s, cambie el tipo de \\\"ns_first_ino\\\" de entero con signo a entero sin signo para evitar la necesidad de conversi\u00f3n de tipos en comparaciones como la verificaci\u00f3n de l\u00edmite inferior introducida esta vez.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/08cab183a624ba71603f3754643ae11cab34dbc4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/1c91058425a01131ea30dda6cf43c67b17884d6a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3be4dcc8d7bea52ea41f87aa4bbf959efe7a5987\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/57235c3c88bb430043728d0d02f44a4efe386476\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/731011ac6c37cbe97ece229fc6daa486276052c5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9194f8ca57527958bee207919458e372d638d783\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e2fec219a36e0993642844be0f345513507031f4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fae1959d6ab2c52677b113935e36ab4e25df37ea\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/08cab183a624ba71603f3754643ae11cab34dbc4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/1c91058425a01131ea30dda6cf43c67b17884d6a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/3be4dcc8d7bea52ea41f87aa4bbf959efe7a5987\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/57235c3c88bb430043728d0d02f44a4efe386476\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/731011ac6c37cbe97ece229fc6daa486276052c5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/9194f8ca57527958bee207919458e372d638d783\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/e2fec219a36e0993642844be0f345513507031f4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/fae1959d6ab2c52677b113935e36ab4e25df37ea\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.