CVE-2024-26688

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super

When configuring a hugetlb filesystem via the fsconfig() syscall, there is

a possible NULL dereference in hugetlbfs_fill_super() caused by assigning

NULL to ctx->hstate in hugetlbfs_parse_param() when the requested pagesize

is non valid.

E.g: Taking the following steps:

fd = fsopen("hugetlbfs", FSOPEN_CLOEXEC);

fsconfig(fd, FSCONFIG_SET_STRING, "pagesize", "1024", 0);

fsconfig(fd, FSCONFIG_CMD_CREATE, NULL, NULL, 0);

Given that the requested "pagesize" is invalid, ctxt->hstate will be replaced

with NULL, losing its previous value, and we will print an error:

...

...

case Opt_pagesize:

ps = memparse(param->string, &rest);

ctx->hstate = h;

if (!ctx->hstate) {

pr_err("Unsupported page size %lu MB\n", ps / SZ_1M);

return -EINVAL;

}

return 0;

...

...

This is a problem because later on, we will dereference ctxt->

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References