CVE-2024-38599

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> jffs2: prevent xattr node from overflowing the eraseblock<br /> <br /> Add a check to make sure that the requested xattr node size is no larger<br /> than the eraseblock minus the cleanmarker.<br /> <br /> Unlike the usual inode nodes, the xattr nodes aren&amp;#39;t split into parts<br /> and spread across multiple eraseblocks, which means that a xattr node<br /> must not occupy more than one eraseblock. If the requested xattr value is<br /> too large, the xattr node can spill onto the next eraseblock, overwriting<br /> the nodes and causing errors such as:<br /> <br /> jffs2: argh. node added in wrong place at 0x0000b050(2)<br /> jffs2: nextblock 0x0000a000, expected at 0000b00c<br /> jffs2: error: (823) do_verify_xattr_datum: node CRC failed at 0x01e050,<br /> read=0xfc892c93, calc=0x000000<br /> jffs2: notice: (823) jffs2_get_inode_nodes: Node header CRC failed<br /> at 0x01e00c. {848f,2fc4,0fef511f,59a3d171}<br /> jffs2: Node at 0x0000000c with length 0x00001044 would run over the<br /> end of the erase block<br /> jffs2: Perhaps the file system was created with the wrong erase size?<br /> jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found<br /> at 0x00000010: 0x1044 instead<br /> <br /> This breaks the filesystem and can lead to KASAN crashes such as:<br /> <br /> BUG: KASAN: slab-out-of-bounds in jffs2_sum_add_kvec+0x125e/0x15d0<br /> Read of size 4 at addr ffff88802c31e914 by task repro/830<br /> CPU: 0 PID: 830 Comm: repro Not tainted 6.9.0-rc3+ #1<br /> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),<br /> BIOS Arch Linux 1.16.3-1-1 04/01/2014<br /> Call Trace:<br /> <br /> dump_stack_lvl+0xc6/0x120<br /> print_report+0xc4/0x620<br /> ? __virt_addr_valid+0x308/0x5b0<br /> kasan_report+0xc1/0xf0<br /> ? jffs2_sum_add_kvec+0x125e/0x15d0<br /> ? jffs2_sum_add_kvec+0x125e/0x15d0<br /> jffs2_sum_add_kvec+0x125e/0x15d0<br /> jffs2_flash_direct_writev+0xa8/0xd0<br /> jffs2_flash_writev+0x9c9/0xef0<br /> ? __x64_sys_setxattr+0xc4/0x160<br /> ? do_syscall_64+0x69/0x140<br /> ? entry_SYSCALL_64_after_hwframe+0x76/0x7e<br /> [...]<br /> <br /> Found by Linux Verification Center (linuxtesting.org) with Syzkaller.