CVE-2024-44939

In the Linux kernel, the following vulnerability has been resolved:

jfs: fix null ptr deref in dtInsertEntry

[syzbot reported] general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 PID: 5061 Comm: syz-executor404 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 RIP: 0010:dtInsertEntry+0xd0c/0x1780 fs/jfs/jfs_dtree.c:3713 ... [Analyze] In dtInsertEntry(), when the pointer h has the same value as p, after writing name in UniStrncpy_to_le(), p->header.flag will be cleared. This will cause the previously true judgment "p->header.flag & BT-LEAF" to change to no after writing the name operation, this leads to entering an incorrect branch and accessing the uninitialized object ih when judging this condition for the second time.

[Fix] After got the page, check freelist first, if freelist == 0 then exit dtInsert() and return -EINVAL.

A low impact null pointer dereference flaw was found in the Linux kernel's JFS file system implementation, in the dtInsertEntry() function of fs/jfs/jfs_dtree.c. When the pointers h and p reference the same B-tree page, writing the new directory entry name with UniStrncpy_to_le() clears the page header flag bits; the previously true "p->header.flag & BT_LEAF" condition then evaluates as false when checked a second time, so the code takes an incorrect branch and accesses the uninitialized object ih, causing a general protection fault and crashing the kernel. The issue was found through syzkaller fuzzing, and triggering it requires local access with the ability to perform directory operations on a crafted JFS file system. The impact is limited to availability (local denial of service), which is reflected in the Red Hat CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The CVE.org record assigns a higher score of 7.8 claiming high confidentiality and integrity impact; Red Hat assesses this flaw as low impact because the verified defect is a null pointer dereference in the JFS directory insertion path that only crashes the kernel and does not affect confidentiality or integrity. Of the currently tracked products, only the Fedora community kernel stream is affected; it is handled under a delegated resolution, with the fix tracked and delivered through the community update process. The Red Hat Enterprise Linux 6, 7, 8, and 9 kernel and kernel-rt streams are assessed as not affected, so no Red Hat Enterprise Linux exposure is currently tracked for this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.