| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-49957: ocfs2: fix null-ptr-deref when journal load failed. |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| ocfs2: fix null-ptr-deref when journal load failed. |
| |
| During the mounting process, if journal_reset() fails because of too short |
| journal, then lead to jbd2_journal_load() fails with NULL j_sb_buffer. |
| Subsequently, ocfs2_journal_shutdown() calls |
| jbd2_journal_flush()->jbd2_cleanup_journal_tail()-> |
| __jbd2_update_log_tail()->jbd2_journal_update_sb_log_tail() |
| ->lock_buffer(journal->j_sb_buffer), resulting in a null-pointer |
| dereference error. |
| |
| To resolve this issue, we should check the JBD2_LOADED flag to ensure the |
| journal was properly loaded. Additionally, use journal instead of |
| osb->journal directly to simplify the code. |
| |
| The Linux kernel CVE team has assigned CVE-2024-49957 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 2.6.32 with commit f6f50e28f0cb8d7bcdfaacc83129f005dede11b1 and fixed in 4.19.323 with commit fd89d92c1140cee8f59de336cb37fa65e359c123 |
| Issue introduced in 2.6.32 with commit f6f50e28f0cb8d7bcdfaacc83129f005dede11b1 and fixed in 5.4.285 with commit 703b2c7e0798d263154dc8593dc2345f75dc077f |
| Issue introduced in 2.6.32 with commit f6f50e28f0cb8d7bcdfaacc83129f005dede11b1 and fixed in 5.10.227 with commit bf605ae98dab5c15c5b631d4d7f88898cb41b649 |
| Issue introduced in 2.6.32 with commit f6f50e28f0cb8d7bcdfaacc83129f005dede11b1 and fixed in 5.15.168 with commit ff55291fb36779819211b596da703389135f5b05 |
| Issue introduced in 2.6.32 with commit f6f50e28f0cb8d7bcdfaacc83129f005dede11b1 and fixed in 6.1.113 with commit 82dfdd1e31e774578f76ce6dc90c834f96403a0f |
| Issue introduced in 2.6.32 with commit f6f50e28f0cb8d7bcdfaacc83129f005dede11b1 and fixed in 6.6.55 with commit 86a89e75e9e4dfa768b97db466ad6bedf2e7ea5b |
| Issue introduced in 2.6.32 with commit f6f50e28f0cb8d7bcdfaacc83129f005dede11b1 and fixed in 6.10.14 with commit f60e94a83db799bde625ac8671a5b4a6354e7120 |
| Issue introduced in 2.6.32 with commit f6f50e28f0cb8d7bcdfaacc83129f005dede11b1 and fixed in 6.11.3 with commit 387bf565cc03e2e8c720b8b4798efea4aacb6962 |
| Issue introduced in 2.6.32 with commit f6f50e28f0cb8d7bcdfaacc83129f005dede11b1 and fixed in 6.12 with commit 5784d9fcfd43bd853654bb80c87ef293b9e8e80a |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-49957 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| fs/ocfs2/journal.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/fd89d92c1140cee8f59de336cb37fa65e359c123 |
| https://git.kernel.org/stable/c/703b2c7e0798d263154dc8593dc2345f75dc077f |
| https://git.kernel.org/stable/c/bf605ae98dab5c15c5b631d4d7f88898cb41b649 |
| https://git.kernel.org/stable/c/ff55291fb36779819211b596da703389135f5b05 |
| https://git.kernel.org/stable/c/82dfdd1e31e774578f76ce6dc90c834f96403a0f |
| https://git.kernel.org/stable/c/86a89e75e9e4dfa768b97db466ad6bedf2e7ea5b |
| https://git.kernel.org/stable/c/f60e94a83db799bde625ac8671a5b4a6354e7120 |
| https://git.kernel.org/stable/c/387bf565cc03e2e8c720b8b4798efea4aacb6962 |
| https://git.kernel.org/stable/c/5784d9fcfd43bd853654bb80c87ef293b9e8e80a |
