{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-40952","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-07-12T12:17:45.592Z","datePublished":"2024-07-12T12:31:56.160Z","dateUpdated":"2025-05-04T09:18:39.596Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2025-05-04T09:18:39.596Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix NULL pointer dereference in ocfs2_journal_dirty()\n\nbdev->bd_super has been removed and commit 8887b94d9322 change the usage\nfrom bdev->bd_super to b_assoc_map->host->i_sb.  This introduces the\nfollowing NULL pointer dereference in ocfs2_journal_dirty() since\nb_assoc_map is still not initialized.  This can be easily reproduced by\nrunning xfstests generic/186, which simulate no more credits.\n\n[  134.351592] BUG: kernel NULL pointer dereference, address: 0000000000000000\n...\n[  134.355341] RIP: 0010:ocfs2_journal_dirty+0x14f/0x160 [ocfs2]\n...\n[  134.365071] Call Trace:\n[  134.365312]  <TASK>\n[  134.365524]  ? __die_body+0x1e/0x60\n[  134.365868]  ? page_fault_oops+0x13d/0x4f0\n[  134.366265]  ? __pfx_bit_wait_io+0x10/0x10\n[  134.366659]  ? schedule+0x27/0xb0\n[  134.366981]  ? exc_page_fault+0x6a/0x140\n[  134.367356]  ? asm_exc_page_fault+0x26/0x30\n[  134.367762]  ? ocfs2_journal_dirty+0x14f/0x160 [ocfs2]\n[  134.368305]  ? ocfs2_journal_dirty+0x13d/0x160 [ocfs2]\n[  134.368837]  ocfs2_create_new_meta_bhs.isra.51+0x139/0x2e0 [ocfs2]\n[  134.369454]  ocfs2_grow_tree+0x688/0x8a0 [ocfs2]\n[  134.369927]  ocfs2_split_and_insert.isra.67+0x35c/0x4a0 [ocfs2]\n[  134.370521]  ocfs2_split_extent+0x314/0x4d0 [ocfs2]\n[  134.371019]  ocfs2_change_extent_flag+0x174/0x410 [ocfs2]\n[  134.371566]  ocfs2_add_refcount_flag+0x3fa/0x630 [ocfs2]\n[  134.372117]  ocfs2_reflink_remap_extent+0x21b/0x4c0 [ocfs2]\n[  134.372994]  ? inode_update_timestamps+0x4a/0x120\n[  134.373692]  ? __pfx_ocfs2_journal_access_di+0x10/0x10 [ocfs2]\n[  134.374545]  ? __pfx_ocfs2_journal_access_di+0x10/0x10 [ocfs2]\n[  134.375393]  ocfs2_reflink_remap_blocks+0xe4/0x4e0 [ocfs2]\n[  134.376197]  ocfs2_remap_file_range+0x1de/0x390 [ocfs2]\n[  134.376971]  ? security_file_permission+0x29/0x50\n[  134.377644]  vfs_clone_file_range+0xfe/0x320\n[  134.378268]  ioctl_file_clone+0x45/0xa0\n[  134.378853]  do_vfs_ioctl+0x457/0x990\n[  134.379422]  __x64_sys_ioctl+0x6e/0xd0\n[  134.379987]  do_syscall_64+0x5d/0x170\n[  134.380550]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[  134.381231] RIP: 0033:0x7fa4926397cb\n[  134.381786] Code: 73 01 c3 48 8b 0d bd 56 38 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 8d 56 38 00 f7 d8 64 89 01 48\n[  134.383930] RSP: 002b:00007ffc2b39f7b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\n[  134.384854] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007fa4926397cb\n[  134.385734] RDX: 00007ffc2b39f7f0 RSI: 000000004020940d RDI: 0000000000000003\n[  134.386606] RBP: 0000000000000000 R08: 00111a82a4f015bb R09: 00007fa494221000\n[  134.387476] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\n[  134.388342] R13: 0000000000f10000 R14: 0000558e844e2ac8 R15: 0000000000f10000\n[  134.389207]  </TASK>\n\nFix it by only aborting transaction and journal in ocfs2_journal_dirty()\nnow, and leave ocfs2_abort() later when detecting an aborted handle,\ne.g. start next transaction. Also log the handle details in this case."}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ocfs2/journal.c"],"versions":[{"version":"8887b94d93224e0ef7e1bc6369640e313b8b12f4","lessThan":"0550ad87711f815b3d73e487ec58ca7d8f56edbc","status":"affected","versionType":"git"},{"version":"8887b94d93224e0ef7e1bc6369640e313b8b12f4","lessThan":"72663d3e09091f431a0774227ca207c0358362dd","status":"affected","versionType":"git"},{"version":"8887b94d93224e0ef7e1bc6369640e313b8b12f4","lessThan":"58f7e1e2c9e72c7974054c64c3abeac81c11f822","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ocfs2/journal.c"],"versions":[{"version":"6.6","status":"affected"},{"version":"0","lessThan":"6.6","status":"unaffected","versionType":"semver"},{"version":"6.6.36","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.9.7","lessThanOrEqual":"6.9.*","status":"unaffected","versionType":"semver"},{"version":"6.10","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.6.36"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.9.7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.10"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/0550ad87711f815b3d73e487ec58ca7d8f56edbc"},{"url":"https://git.kernel.org/stable/c/72663d3e09091f431a0774227ca207c0358362dd"},{"url":"https://git.kernel.org/stable/c/58f7e1e2c9e72c7974054c64c3abeac81c11f822"}],"title":"ocfs2: fix NULL pointer dereference in ocfs2_journal_dirty()","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T04:39:55.281Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/0550ad87711f815b3d73e487ec58ca7d8f56edbc","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/72663d3e09091f431a0774227ca207c0358362dd","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/58f7e1e2c9e72c7974054c64c3abeac81c11f822","tags":["x_transferred"]}]},{"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-40952","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-09-10T17:03:55.352305Z"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-09-11T17:34:24.609Z"}}]}}