CVE-2024-26590

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-26590
In the Linux kernel, the following vulnerability has been resolved: erofs: fix inconsistent per-file compression format EROFS can select compression algorithms on a per-file basis, and each per-file compression algorithm needs to be marked in the on-disk superblock for initialization. However, syzkaller can generate inconsistent crafted images that use an unsupported algorithmtype for specific inodes, e.g. use MicroLZMA algorithmtype even it's not set in `sbi->available_compr_algs`. This can lead to an unexpected "BUG: kernel NULL pointer dereference" if the corresponding decompressor isn't built-in. Fix this by checking against `sbi->available_compr_algs` for each m_algorithmformat request. Incorrect !erofs_sb_has_compr_cfgs preset bitmap is now fixed together since it was harmless previously.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/118a8cf504d7dfa519562d000f423ee3ca75d2c4 Patch
https://git.kernel.org/stable/c/47467e04816cb297905c0f09bc2d11ef865942d9 Patch
https://git.kernel.org/stable/c/823ba1d2106019ddf195287ba53057aee33cf724 Patch
https://git.kernel.org/stable/c/eed24b816e50c6cd18cbee0ff0d7218c8fced199 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

18 Mar 2024, 17:54

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/118a8cf504d7dfa519562d000f423ee3ca75d2c4 - () https://git.kernel.org/stable/c/118a8cf504d7dfa519562d000f423ee3ca75d2c4 - Patch
References () https://git.kernel.org/stable/c/47467e04816cb297905c0f09bc2d11ef865942d9 - () https://git.kernel.org/stable/c/47467e04816cb297905c0f09bc2d11ef865942d9 - Patch
References () https://git.kernel.org/stable/c/823ba1d2106019ddf195287ba53057aee33cf724 - () https://git.kernel.org/stable/c/823ba1d2106019ddf195287ba53057aee33cf724 - Patch
References () https://git.kernel.org/stable/c/eed24b816e50c6cd18cbee0ff0d7218c8fced199 - () https://git.kernel.org/stable/c/eed24b816e50c6cd18cbee0ff0d7218c8fced199 - Patch
CWE CWE-476
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux linux Kernel
Linux

01 Mar 2024, 14:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/47467e04816cb297905c0f09bc2d11ef865942d9 -
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: erofs: corrige el formato de compresión por archivo inconsistente EROFS puede seleccionar algoritmos de compresión por archivo, y cada algoritmo de compresión por archivo debe marcarse en el superbloque del disco para la inicialización. Sin embargo, syzkaller puede generar imágenes manipuladas inconsistentes que usan un tipo de algoritmo no compatible para inodos específicos, por ejemplo, usa el tipo de algoritmo MicroLZMA incluso si no está configurado en `sbi->available_compr_algs`. Esto puede provocar un "ERROR: desreferencia del puntero NULL del kernel" inesperado si el descompresor correspondiente no está integrado. Solucione este problema comprobando con `sbi->available_compr_algs` para cada solicitud de m_algorithmformat. El mapa de bits preestablecido !erofs_sb_has_compr_cfgs incorrecto ahora se corrige porque antes era inofensivo.

22 Feb 2024, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-22 17:15

Updated : 2024-03-18 17:54

NVD link : CVE-2024-26590

Mitre link : CVE-2024-26590

CVE.ORG link : CVE-2024-26590

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference