CyberSecBulletin
CVE-2024-39467NVD status: Modified

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2024-39467 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 7.1 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions c559a8d840562fbfce9f318448dda2f7d3e6d8e8, 75c87e2ac6149abf44bdde0dd6d541763ddb0dff, 1640dcf383cdba52be8b28d2a1a2aa7ef7a30c98 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.24% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to c559a8d840562fbfce9f318448dda2f7d3e6d8e8 or 75c87e2ac6149abf44bdde0dd6d541763ddb0dff or 1640dcf383cdba52be8b28d2a1a2aa7ef7a30c98 or 8c8aa473fe6eb46a4bf99f3ea2dbe52bf0c1a1f0, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.4.278 or 5.10.219 or 5.15.161 or 6.1.94, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux98e4da8ca301e062d79ae168c67e56f3c3de3ce4 up to, but not including, c559a8d840562fbfce9f318448dda2f7d3e6d8e8; 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 up to, but not including, 75c87e2ac6149abf44bdde0dd6d541763ddb0dff; 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 up to, but not including, 1640dcf383cdba52be8b28d2a1a2aa7ef7a30c98; 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 up to, but not including, 8c8aa473fe6eb46a4bf99f3ea2dbe52bf0c1a1f0; 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 up to, but not including, be0155202e431f3007778568a72432c68f8946ba; 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 up to, but not including, 68e3cd4ecb8603936cccdc338929130045df2e57; 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 up to, but not including, 20faaf30e55522bba2b56d9c46689233205d7717; 3.8c559a8d840562fbfce9f318448dda2f7d3e6d8e8, 75c87e2ac6149abf44bdde0dd6d541763ddb0dff, 1640dcf383cdba52be8b28d2a1a2aa7ef7a30c98, 8c8aa473fe6eb46a4bf99f3ea2dbe52bf0c1a1f0, be0155202e431f3007778568a72432c68f8946ba, 68e3cd4ecb8603936cccdc338929130045df2e57
LinuxLinux Kernel3.8 up to, but not including, 5.4.278; 5.5 up to, but not including, 5.10.219; 5.11 up to, but not including, 5.15.161; 5.16 up to, but not including, 6.1.94; 6.2 up to, but not including, 6.6.34; 6.7 up to, but not including, 6.9.55.4.278, 5.10.219, 5.15.161, 6.1.94, 6.6.34, 6.9.5

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.17.8HighCNA
CVSS 3.17.1HighNVD

Official description

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode() syzbot reports a kernel bug as below: F2FS-fs (loop0): Mounted with checkpoint version = 48b305e4 ================================================================== BUG: KASAN: slab-out-of-bounds in f2fs_test_bit fs/f2fs/f2fs.h:2933 [inline] BUG: KASAN: slab-out-of-bounds in current_nat_addr fs/f2fs/node.h:213 [inline] BUG: KASAN: slab-out-of-bounds in f2fs_get_node_info+0xece/0x1200 fs/f2fs/node.c:600 Read of size 1 at addr ffff88807a58c76c by task syz-executor280/5076 CPU: 1 PID: 5076 Comm: syz-executor280 Not tainted 6.9.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 f2fs_test_bit fs/f2fs/f2fs.h:2933 [inline] current_nat_addr fs/f2fs/node.h:213 [inline] f2fs_get_node_info+0xece/0x1200 fs/f2fs/node.c:600 f2fs_xattr_fiemap fs/f2fs/data.c:1848 [inline] f2fs_fiemap+0x55d/0x1ee0 fs/f2fs/data.c:1925 ioctl_fiemap fs/ioctl.c:220 [inline] do_vfs_ioctl+0x1c07/0x2e50 fs/ioctl.c:838 __do_sys_ioctl fs/ioctl.c:902 [inline] __se_sys_ioctl+0x81/0x170 fs/ioctl.c:890 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f The root cause is we missed to do sanity check on i_xattr_nid during f2fs_iget(), so that in fiemap() path, current_nat_addr() will access nat_bitmap w/ offset from invalid i_xattr_nid, result in triggering kasan bug report, fix it.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.