CVE-2024-53130

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint

When using the "block:block_dirty_buffer" tracepoint, mark_buffer_dirty()

may cause a NULL pointer dereference, or a general protection fault when

KASAN is enabled.

This happens because, since the tracepoint was added in

mark_buffer_dirty(), it references the dev_t member bh->b_bdev->bd_dev

regardless of whether the buffer head has a pointer to a block_device

structure.

In the current implementation, nilfs_grab_buffer(), which grabs a buffer

to read (or create) a block of metadata, including b-tree node blocks,

does not set the block device, but instead does so only if the buffer is

not in the "uptodate" state for each of its caller block reading

functions. However, if the uptodate flag is set on a folio/page, and the

buffer heads are detached from it by try_to_free_buffers(), and new buffer

heads are then attached by create_empty_buffers(), the uptodate

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References