CVE-2024-49900

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-49900
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-49900.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-49900
Downstream
Related
Published
2024-10-21T18:01:32.607Z
Modified
2026-03-20T12:39:26.793807Z
Summary
jfs: Fix uninit-value access of new_ea in ea_buffer
Details

In the Linux kernel, the following vulnerability has been resolved:

jfs: Fix uninit-value access of newea in eabuffer

syzbot reports that lzo1x1do_compress is using uninit-value:

===================================================== BUG: KMSAN: uninit-value in lzo1x1docompress+0x19f9/0x2510 lib/lzo/lzo1xcompress.c:178

...

Uninit was stored to memory at: ea_put fs/jfs/xattr.c:639 [inline]

...

Local variable ea_buf created at: __jfs_setxattr+0x5d/0x1ae0 fs/jfs/xattr.c:662 __jfsxattrset+0xe6/0x1f0 fs/jfs/xattr.c:934

=====================================================

The reason is eabuf->newea is not initialized properly.

Fix this by using memset to empty its content at the beginning in ea_get().

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/49xxx/CVE-2024-49900.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Fixed
7b24d41d47a6805c45378debf8bd115675d41da8
Fixed
dac398ed272a378d2f42ac68ae408333a51baf52
Fixed
8b1dcf25c26d42e4a68c4725ce52a0543c7878cc
Fixed
d7444f91a9f93eaa48827087ed0f3381c194181d
Fixed
6041536d18c5f51a84bc37cd568cbab61870031e
Fixed
c076b3746224982eebdba5c9e4b1467e146c0d64
Fixed
7c244d5b48284a770d96ff703df2dfeadf804a73
Fixed
8ad8b531de79c348bcb8133e7f5e827b884226af
Fixed
2b59ffad47db1c46af25ccad157bb3b25147c35c

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-49900.json"