CVE-2024-39467 in Linux
Summary
by MITRE • 06/25/2024
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode()
syzbot reports a kernel bug as below:
F2FS-fs (loop0): Mounted with checkpoint version = 48b305e4 ================================================================== BUG: KASAN: slab-out-of-bounds in f2fs_test_bit fs/f2fs/f2fs.h:2933 [inline]
BUG: KASAN: slab-out-of-bounds in current_nat_addr fs/f2fs/node.h:213 [inline]
BUG: KASAN: slab-out-of-bounds in f2fs_get_node_info+0xece/0x1200 fs/f2fs/node.c:600 Read of size 1 at addr ffff88807a58c76c by task syz-executor280/5076
CPU: 1 PID: 5076 Comm: syz-executor280 Not tainted 6.9.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 f2fs_test_bit fs/f2fs/f2fs.h:2933 [inline]
current_nat_addr fs/f2fs/node.h:213 [inline]
f2fs_get_node_info+0xece/0x1200 fs/f2fs/node.c:600 f2fs_xattr_fiemap fs/f2fs/data.c:1848 [inline]
f2fs_fiemap+0x55d/0x1ee0 fs/f2fs/data.c:1925 ioctl_fiemap fs/ioctl.c:220 [inline]
do_vfs_ioctl+0x1c07/0x2e50 fs/ioctl.c:838 __do_sys_ioctl fs/ioctl.c:902 [inline]
__se_sys_ioctl+0x81/0x170 fs/ioctl.c:890 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f
The root cause is we missed to do sanity check on i_xattr_nid during f2fs_iget(), so that in fiemap() path, current_nat_addr() will access nat_bitmap w/ offset from invalid i_xattr_nid, result in triggering kasan bug report, fix it.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/07/2026
The vulnerability identified as CVE-2024-39467 affects the Linux kernel's F2FS (Flash-Friendly File System) implementation and represents a critical out-of-bounds memory access issue that can lead to kernel crashes and potential privilege escalation. This flaw manifests when the kernel performs file system operations that access extended attributes, specifically during the fiemap ioctl operation. The vulnerability was discovered through automated fuzzing by syzbot, which identified a kernel address sanitizer (KASAN) report indicating a slab-out-of-bounds access in the f2fs_test_bit function. The issue occurs in the context of file system metadata handling where invalid memory offsets are accessed during node information retrieval operations.
The technical root cause of this vulnerability lies in the missing sanity check for the i_xattr_nid field within the f2fs_iget() function. The i_xattr_nid represents the node ID for extended attribute storage in F2FS, and when this value is not properly validated during inode initialization, it can contain invalid or uninitialized data. This allows subsequent operations in the fiemap path to reference memory locations that are outside the valid bounds of the NAT (Node Address Table) bitmap structure. The call trace demonstrates that the vulnerability is triggered when f2fs_get_node_info() attempts to access current_nat_addr() with an invalid offset derived from the unchecked i_xattr_nid value, leading to a direct memory access violation that KASAN detects and reports.
The operational impact of this vulnerability is significant as it can result in kernel panics and system crashes when legitimate file system operations are performed on F2FS volumes. The vulnerability specifically affects the fiemap ioctl operation which is commonly used to query file layout information and is part of standard file system management utilities. This creates a potential denial-of-service condition where any process attempting to perform fiemap operations on files stored on F2FS volumes could trigger the kernel bug. Additionally, the nature of the out-of-bounds access could potentially be exploited to achieve information disclosure or privilege escalation depending on the system configuration and the specific memory layout at the time of exploitation. This vulnerability directly maps to CWE-129, which covers insufficient input validation, and aligns with ATT&CK technique T1068, which involves exploiting privileges to escalate access.
The mitigation strategy for this vulnerability requires applying the kernel patch that implements proper sanity checking of the i_xattr_nid field during inode initialization. The fix ensures that before any extended attribute operations are performed, the system validates that the i_xattr_nid value falls within acceptable ranges and does not contain invalid offsets that could lead to memory access violations. System administrators should prioritize updating their Linux kernel installations to versions containing this fix, particularly those running F2FS file systems in production environments. Organizations should also monitor their systems for any kernel crash reports or unexpected behavior that might indicate this vulnerability is being exploited, as the KASAN reports provide clear indicators of the specific memory access violations that occur. Regular kernel updates and proper system hardening practices remain essential for maintaining security posture against such low-level kernel vulnerabilities that can affect system stability and security.