In the Linux kernel, the following vulnerability has been resolved:
jfs: fix null ptr deref in dtInsertEntry
[syzbot reported] general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 PID: 5061 Comm: syz-executor404 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 RIP: 0010:dtInsertEntry+0xd0c/0x1780 fs/jfs/jfsdtree.c:3713 ... [Analyze] In dtInsertEntry(), when the pointer h has the same value as p, after writing name in UniStrncpyto_le(), p->header.flag will be cleared. This will cause the previously true judgment "p->header.flag & BT-LEAF" to change to no after writing the name operation, this leads to entering an incorrect branch and accessing the uninitialized object ih when judging this condition for the second time.
[Fix] After got the page, check freelist first, if freelist == 0 then exit dtInsert() and return -EINVAL.
[
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f98bf80b20f4a930589cda48a35f751a64fe0dc2",
"signature_type": "Line",
"target": {
"file": "fs/jfs/jfs_dtree.c"
},
"id": "CVE-2024-44939-11b295dd",
"digest": {
"line_hashes": [
"132347005396354639403663591438321235778",
"273157706819904837485435286352202686364",
"232225287271952006380066512896752884390",
"28747553567010349464193499439445280451"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@53023ab11836ac56fd75f7a71ec1356e50920fa9",
"signature_type": "Line",
"target": {
"file": "fs/jfs/jfs_dtree.c"
},
"id": "CVE-2024-44939-1f9407ea",
"digest": {
"line_hashes": [
"132347005396354639403663591438321235778",
"273157706819904837485435286352202686364",
"232225287271952006380066512896752884390",
"28747553567010349464193499439445280451"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@53023ab11836ac56fd75f7a71ec1356e50920fa9",
"signature_type": "Function",
"target": {
"function": "dtInsert",
"file": "fs/jfs/jfs_dtree.c"
},
"id": "CVE-2024-44939-3fd8287b",
"digest": {
"length": 1475.0,
"function_hash": "141250421055795714587850799954199985091"
},
"deprecated": false
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ce6dede912f064a855acf6f04a04cbb2c25b8c8c",
"signature_type": "Function",
"target": {
"function": "dtInsert",
"file": "fs/jfs/jfs_dtree.c"
},
"id": "CVE-2024-44939-413244c9",
"digest": {
"length": 1475.0,
"function_hash": "141250421055795714587850799954199985091"
},
"deprecated": false
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f98bf80b20f4a930589cda48a35f751a64fe0dc2",
"signature_type": "Function",
"target": {
"function": "dtInsert",
"file": "fs/jfs/jfs_dtree.c"
},
"id": "CVE-2024-44939-6ed1edab",
"digest": {
"length": 1475.0,
"function_hash": "141250421055795714587850799954199985091"
},
"deprecated": false
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ce6dede912f064a855acf6f04a04cbb2c25b8c8c",
"signature_type": "Line",
"target": {
"file": "fs/jfs/jfs_dtree.c"
},
"id": "CVE-2024-44939-a6f593d3",
"digest": {
"line_hashes": [
"132347005396354639403663591438321235778",
"273157706819904837485435286352202686364",
"232225287271952006380066512896752884390",
"28747553567010349464193499439445280451"
],
"threshold": 0.9
},
"deprecated": false
}
]