CVE-2024-44939

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

jfs: fix null ptr deref in dtInsertEntry

[syzbot reported]

general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN PTI

KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]

CPU: 0 PID: 5061 Comm: syz-executor404 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024

RIP: 0010:dtInsertEntry+0xd0c/0x1780 fs/jfs/jfs_dtree.c:3713

...

[Analyze]

In dtInsertEntry(), when the pointer h has the same value as p, after writing

name in UniStrncpy_to_le(), p->header.flag will be cleared. This will cause the

previously true judgment "p->header.flag & BT-LEAF" to change to no after writing

the name operation, this leads to entering an incorrect branch and accessing the

uninitialized object ih when judging this condition for the second time.

[Fix]

After got the page, check freel

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References