CVE-2024-38599

A vulnerability was found in the Linux kernel in the do_jffs2_setxattr() function where improper checks can lead to an out-of-bounds write error. This can occur when the requested xattr node size is larger than the size allocate by an eraseblock, which causes the xattr node to spill onto the next eraseblock, overwriting the nodes and potentially causing errors. This vulnerability can potentially lead to data corruption or system instability.

A moderate impact out-of-bounds write flaw was found in the Linux kernel's JFFS2 file system. The do_jffs2_setxattr() function did not verify that the requested extended attribute (xattr) node size fits within a single erase block. Because JFFS2 xattr nodes are not split across erase blocks, a local privileged user could set an xattr value so large that the node spills onto the next erase block and overwrites existing nodes, corrupting the file system and potentially triggering out-of-bounds memory accesses that crash the kernel, resulting in data corruption, errors, or a denial of service (system instability). Red Hat Product Security has rated this flaw Moderate severity (CVSS 3.1 score of 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local privileged access to a system with a JFFS2 file system and the impact is limited to availability; the higher NIST (7.1, Important) and CVE.org (7.8, Important) scores additionally credit confidentiality and integrity impacts that are not supported by Red Hat's assessment. According to the current Red Hat affectedness records, Red Hat Enterprise Linux (kernel and kernel-rt) across supported releases, as well as the Hosted OpenShift (ARO/OSD) and Fedora kernel components, are not affected by this flaw; the Red Hat Enterprise Linux 6 Extended Lifecycle Support kernel stream is out of support scope.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.