CVE-2024-56619: nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()
Syzbot reported that when searching for records in a directory where the
inode's i_size is corrupted and has a large value, memory access outside
the folio/page range may occur, or a use-after-free bug may be detected if
KASAN is enabled.
This is because nilfs_last_byte(), which is called by nilfs_find_entry()
and others to calculate the number of valid bytes of directory data in a
page from i_size and the page index, loses the upper 32 bits of the 64-bit
size information due to an inappropriate type of local variable to which
the i_size value is assigned.
This caused a large byte offset value due to underflow in the end address
calculation in the calling nilfs_find_entry(), resulting in memory access
that exceeds the folio/page size.
Fix this issue by changing the type of the local variable causing the bit
loss from "unsigned int" to "u64". The return value of nilfs_last_byte()
is also of type "unsigned int", but it is truncated so as not to exceed
PAGE_SIZE and no bit loss occurs, so no change is required.
Security readout for executives and security teams
Plain-English summary
A flaw in Linux NILFS2 directory handling can make the kernel access memory outside a page when processing corrupted directory metadata. A locally authenticated user may be able to trigger serious confidentiality, integrity, or availability impacts. Systems not using NILFS2 are less likely to be exposed.
Executive priority
Treat as a high-priority kernel maintenance issue for systems using NILFS2, especially multi-user or untrusted-data environments. Confirm exposure promptly and deploy vendor-supported updates through normal kernel patching processes. Systems without NILFS2 use can be deprioritized after validation.
Technical view
A 64-bit inode size was assigned to an unsigned int in nilfs_last_byte(), discarding its upper bits. Subsequent arithmetic in nilfs_find_entry() could underflow and produce an excessive offset, causing out-of-bounds access or a KASAN-detected use-after-free. The upstream correction changes the local variable to u64.
Likely exposure
Exposure is most plausible on affected Linux kernels where NILFS2 is available and corrupted directory metadata is processed. The CVSS vector indicates local access, low privileges, low complexity, and no user interaction. The supplied version data is ambiguous, so exact vulnerable release boundaries require vendor confirmation.
Exploitation context
The supplied evidence attributes discovery to syzbot and does not establish real-world exploitation. CVE-2024-56619 is not identified as KEV in the bundle. The reported condition involves a corrupted inode size during NILFS2 directory searching; no remote attack path is documented.
Researcher notes
The bundle lists CVSS 3.1 score 7.8 and CWE-416. Although use-after-free is reported under KASAN, the described root cause is integer truncation leading to underflow and out-of-bounds access. Flattened version entries do not clearly express ranges or fixed boundaries; consult the CVE record, stable commits, and distribution advisories.
Mitigation direction
Apply a distribution or kernel update containing the referenced upstream NILFS2 correction.
Confirm fixed package versions through the applicable Linux vendor advisory.
Where operationally feasible, avoid processing untrusted or corrupted NILFS2 filesystems until patched.
Prioritize systems permitting lower-privileged users to interact with NILFS2 data.
Validation and detection
Record the running kernel and installed package versions on potentially exposed systems.
Determine whether NILFS2 support is enabled, loaded, mounted, or operationally required.
Compare vendor package status with the referenced stable-kernel fixes.
On instrumented test systems, review KASAN reports for NILFS2 out-of-bounds or use-after-free findings.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cwe · low confidence lookup
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
2CVSS vectors
3Timeline events
2ADP providers
10Source links
SSVC decision data
CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: total
CVSS vector scores
2 official scores
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
CWE-416 · source CWE mapping
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.