LiveActive security incident?Get immediate response
CVE Record

CVE-2024-56619: nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry() Syzbot reported that when searching for records in a directory where the inode's i_size is corrupted and has a large value, memory access outside the folio/page range may occur, or a use-after-free bug may be detected if KASAN is enabled. This is because nilfs_last_byte(), which is called by nilfs_find_entry() and others to calculate the number of valid bytes of directory data in a page from i_size and the page index, loses the upper 32 bits of the 64-bit size information due to an inappropriate type of local variable to which the i_size value is assigned. This caused a large byte offset value due to underflow in the end address calculation in the calling nilfs_find_entry(), resulting in memory access that exceeds the folio/page size. Fix this issue by changing the type of the local variable causing the bit loss from "unsigned int" to "u64". The return value of nilfs_last_byte() is also of type "unsigned int", but it is truncated so as not to exceed PAGE_SIZE and no bit loss occurs, so no change is required.

HighCVSS 7.8Not KEV-listedUpdated
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A flaw in Linux NILFS2 directory handling can make the kernel access memory outside a page when processing corrupted directory metadata. A locally authenticated user may be able to trigger serious confidentiality, integrity, or availability impacts. Systems not using NILFS2 are less likely to be exposed.

Executive priority

Treat as a high-priority kernel maintenance issue for systems using NILFS2, especially multi-user or untrusted-data environments. Confirm exposure promptly and deploy vendor-supported updates through normal kernel patching processes. Systems without NILFS2 use can be deprioritized after validation.

Technical view

A 64-bit inode size was assigned to an unsigned int in nilfs_last_byte(), discarding its upper bits. Subsequent arithmetic in nilfs_find_entry() could underflow and produce an excessive offset, causing out-of-bounds access or a KASAN-detected use-after-free. The upstream correction changes the local variable to u64.

Likely exposure

Exposure is most plausible on affected Linux kernels where NILFS2 is available and corrupted directory metadata is processed. The CVSS vector indicates local access, low privileges, low complexity, and no user interaction. The supplied version data is ambiguous, so exact vulnerable release boundaries require vendor confirmation.

Exploitation context

The supplied evidence attributes discovery to syzbot and does not establish real-world exploitation. CVE-2024-56619 is not identified as KEV in the bundle. The reported condition involves a corrupted inode size during NILFS2 directory searching; no remote attack path is documented.

Researcher notes

The bundle lists CVSS 3.1 score 7.8 and CWE-416. Although use-after-free is reported under KASAN, the described root cause is integer truncation leading to underflow and out-of-bounds access. Flattened version entries do not clearly express ranges or fixed boundaries; consult the CVE record, stable commits, and distribution advisories.

Mitigation direction

  • Apply a distribution or kernel update containing the referenced upstream NILFS2 correction.
  • Confirm fixed package versions through the applicable Linux vendor advisory.
  • Where operationally feasible, avoid processing untrusted or corrupted NILFS2 filesystems until patched.
  • Prioritize systems permitting lower-privileged users to interact with NILFS2 data.

Validation and detection

  • Record the running kernel and installed package versions on potentially exposed systems.
  • Determine whether NILFS2 support is enabled, loaded, mounted, or operationally required.
  • Compare vendor package status with the referenced stable-kernel fixes.
  • On instrumented test systems, review KASAN reports for NILFS2 out-of-bounds or use-after-free findings.
Prepared
Confidence
medium
Sources
6

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-416: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2024-56619 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
3Timeline events
2ADP providers
10Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: total

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2024-56619Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc
CVECVE Program Container
Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux2ba466d74ed74f073257f86e61519cb8f8f46184, 2ba466d74ed74f073257f86e61519cb8f8f46184, 2ba466d74ed74f073257f86e61519cb8f8f46184, 2ba466d74ed74f073257f86e61519cb8f8f46184, 2ba466d74ed74f073257f86e61519cb8f8f46184, 2ba466d74ed74f073257f86e61519cb8f8f46184, 2ba466d74ed74f073257f86e61519cb8f8f46184unaffected
LinuxLinux2.6.30, 0, 5.4.287, 5.10.231, 5.15.174, 6.1.120, 6.6.66, 6.12.5, 6.13affected
Weakness

CWE details

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-416 · source CWE mapping

Use After Free

Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.