Security readout for executives and security teams
Plain-English summary
A flaw in Linux’s JFS filesystem can make the kernel read beyond a buffer while logging an abnormally sized extended attribute. The supplied CVSS score is 7.8, reflecting potentially serious local impact. Exposure is concentrated on systems that use JFS and allow a low-privileged user to reach the affected operation.
Executive priority
Treat this as a high-priority kernel maintenance issue on JFS-dependent systems, especially multi-user hosts where low-privileged users can reach filesystem operations. Use normal emergency patch governance rather than assuming internet-wide exposure. Confirm distribution-specific fixes promptly because upstream version strings alone may not show backports.
Technical view
CVE-2024-40902 is an out-of-bounds buffer access in JFS extended-attribute diagnostic logging. An unexpected xattr size could cause the hexadecimal debug dump to access beyond the buffer. The kernel fix restricts the dump length. The supplied assessment classifies access as local, low-complexity, and requiring low privileges, without user interaction.
Likely exposure
Likely exposure is limited to Linux systems running an affected kernel and using or processing JFS filesystems. The supplied version data spans multiple kernel branches but does not map every distribution build. Systems without JFS use are less likely to reach the vulnerable code, though kernel and filesystem inventories are needed for confirmation.
Exploitation context
The supplied record does not identify active exploitation, and the CVE is not listed as KEV in the bundle. No public proof-of-concept or confirmed attack evidence is provided. The CVSS vector describes local access requiring low privileges, so this should not be presented as a directly remote vulnerability.
Researcher notes
The record assigns CWE-121 and CVSS 3.1 score 7.8. The described defect is an over-read during debug hex dumping of an invalid JFS xattr, corrected by bounding the dump size. The sources do not establish exploitability beyond the CVSS impact assessment, so confidentiality, integrity, or code-execution outcomes should not be claimed as demonstrated.
Mitigation direction
- Install the distribution-supported kernel update containing the applicable stable JFS fix.
- Prioritize systems that mount, process, or permit user access to JFS filesystems.
- Consult the Linux distribution’s advisory for exact fixed package versions.
- If updates are delayed, follow vendor guidance for reducing JFS exposure; no sourced workaround is provided.
Validation and detection
- Inventory kernel package versions across Linux hosts.
- Identify hosts with JFS support, mounts, images, or operational dependencies.
- Map each distribution kernel build to its vendor advisory or applicable stable fix.
- After updating, verify the running kernel changed and reboot requirements were completed.
- Confirm security scanners recognize the distribution’s backported fix, not only upstream version numbers.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-121: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-40902 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/f0dedb5c511ed82cbaff4997a8decf2351ba549fCVE reference, Linux
- https://git.kernel.org/stable/c/1e84c9b1838152a87cf453270a5fa75c5037e83aCVE reference, Linux
- https://git.kernel.org/stable/c/fc745f6e83cb650f9a5f2c864158e3a5ea76dad0CVE reference, Linux
- https://git.kernel.org/stable/c/480e5bc21f2c42d90c2c16045d64d824dcdd5ec7CVE reference, Linux
- https://git.kernel.org/stable/c/33aecc5799c93d3ee02f853cb94e201f9731f123CVE reference, Linux
- https://git.kernel.org/stable/c/4598233d9748fe4db4e13b9f473588aa25e87d69CVE reference, Linux
- https://git.kernel.org/stable/c/b537cb2f4c4a1357479716a9c339c0bda03d873fCVE reference, Linux
- https://git.kernel.org/stable/c/7c55b78818cfb732680c4a72ab270cc2d2ee3d0fCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Stack-based Buffer Overflow
Stack-based Buffer Overflow represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.