CVE-2024-44939

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-44939

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: jfs: fix null ptr deref in dtInsertEntry [syzbot reported] general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 PID: 5061 Comm: syz-executor404 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 RIP: 0010:dtInsertEntry+0xd0c/0x1780 fs/jfs/jfs_dtree.c:3713 ... [Analyze] In dtInsertEntry(), when the pointer h has the same value as p, after writing name in UniStrncpy_to_le(), p->header.flag will be cleared. This will cause the previously true judgment "p->header.flag & BT-LEAF" to change to no after writing the name operation, this leads to entering an incorrect branch and accessing the uninitialized object ih when judging this condition for the second time. [Fix] After got the page, check freelist first, if freelist == 0 then exit dtInsert() and return -EINVAL.

References
Link Resource
https://git.kernel.org/stable/c/53023ab11836ac56fd75f7a71ec1356e50920fa9 Patch
https://git.kernel.org/stable/c/6ea10dbb1e6c58384136e9adfd75f81951e423f6 Patch
https://git.kernel.org/stable/c/9c2ac38530d1a3ee558834dfa16c85a40fd0e702 Patch
https://git.kernel.org/stable/c/ce6dede912f064a855acf6f04a04cbb2c25b8c8c Patch
https://git.kernel.org/stable/c/f98bf80b20f4a930589cda48a35f751a64fe0dc2
https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

03 Nov 2025, 23:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html -

17 Jul 2025, 17:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/f98bf80b20f4a930589cda48a35f751a64fe0dc2 -

12 Sep 2024, 20:58

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/53023ab11836ac56fd75f7a71ec1356e50920fa9 - () https://git.kernel.org/stable/c/53023ab11836ac56fd75f7a71ec1356e50920fa9 - Patch
References () https://git.kernel.org/stable/c/6ea10dbb1e6c58384136e9adfd75f81951e423f6 - () https://git.kernel.org/stable/c/6ea10dbb1e6c58384136e9adfd75f81951e423f6 - Patch
References () https://git.kernel.org/stable/c/9c2ac38530d1a3ee558834dfa16c85a40fd0e702 - () https://git.kernel.org/stable/c/9c2ac38530d1a3ee558834dfa16c85a40fd0e702 - Patch
References () https://git.kernel.org/stable/c/ce6dede912f064a855acf6f04a04cbb2c25b8c8c - () https://git.kernel.org/stable/c/ce6dede912f064a855acf6f04a04cbb2c25b8c8c - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-476
First Time Linux
Linux linux Kernel
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

29 Aug 2024, 17:15

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: jfs: corrige null ptr deref en dtInsertEntry [syzbot informó] falla de protección general, probablemente para dirección no canónica 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr -deref en rango [0x0000000000000008-0x000000000000000f] CPU: 0 PID: 5061 Comm: syz-executor404 No contaminado 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Nombre de hardware: Google Google Compute Engine/Google Compute Engine, BIOS Google 03 /27 /2024 RIP: 0010:dtInsertEntry+0xd0c/0x1780 fs/jfs/jfs_dtree.c:3713 ... [Analizar] En dtInsertEntry(), cuando el puntero h tiene el mismo valor que p, después de escribir el nombre en UniStrncpy_to_le(), Se borrará p->header.flag. Esto hará que el juicio previamente verdadero "p->header.flag & BT-LEAF" cambie a no después de escribir la operación de nombre, esto lleva a ingresar una rama incorrecta y acceder al objeto no inicializado ih al juzgar esta condición por segunda vez. [Solución] Después de obtener la página, verifique primero la lista libre, si lista libre == 0, salga de dtInsert() y devuelva -EINVAL.
References
  • () https://git.kernel.org/stable/c/53023ab11836ac56fd75f7a71ec1356e50920fa9 -

26 Aug 2024, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-08-26 12:15

Updated : 2025-11-03 23:15

NVD link : CVE-2024-44939

Mitre link : CVE-2024-44939

CVE.ORG link : CVE-2024-44939

JSON object : View

Products Affected

linux

CWE
CWE-476

NULL Pointer Dereference