Security readout for executives and security teams
Plain-English summary
A corrupted JFFS2 filesystem can trigger faulty Linux decompression logic and overwrite memory outside its intended buffer. A successful trigger could compromise confidentiality, integrity, and availability. Exposure is concentrated in systems that use JFFS2 and process untrusted or corrupted filesystem data.
Executive priority
Treat this as a high-priority maintenance issue for exposed embedded devices, appliances, and Linux systems using JFFS2. It is not presented as an internet-remote or actively exploited emergency. Accelerate remediation where untrusted filesystem data can enter operational workflows; otherwise include the fix in the next controlled kernel or firmware update cycle.
Technical view
The JFFS2 rtime decompressor lacked bounds checking across the complete decompression pass, permitting an out-of-bounds write (CWE-787). CVSS 3.1 rates it 7.8: local access, low complexity, no privileges, and user interaction required, with high potential impact to confidentiality, integrity, and availability.
Likely exposure
Prioritize Linux devices that enable and actively use JFFS2, particularly where corrupted or externally supplied filesystem data could be processed. The supplied affected-version data mixes release numbers and commit identifiers, so distribution-specific exposure should be confirmed through vendor advisories rather than inferred solely from the version list.
Exploitation context
The source bundle provides no evidence of active exploitation, and the CVE is not identified as being in CISA KEV. The CVSS vector describes a local, low-complexity condition requiring user interaction but no privileges. Public exploit availability is not established by the supplied sources.
Researcher notes
The vulnerable condition is an out-of-bounds write during rtime decompression of corrupted JFFS2 data. Upstream stable commits add the missing bounds check. The supplied version metadata is ambiguous and should not be treated as a complete branch matrix; verify backports through kernel, distribution, or appliance-vendor records.
Mitigation direction
- Upgrade to a vendor-supported kernel containing the applicable upstream bounds-checking fix.
- Consult the Linux distribution or device vendor advisory for fixed package and firmware versions.
- Restrict processing of untrusted JFFS2 media or images until affected systems are updated.
- Prioritize embedded and appliance fleets where JFFS2 is operationally required.
Validation and detection
- Inventory kernel versions across systems that enable or use JFFS2.
- Compare installed kernels with distribution advisories and the applicable stable-kernel fix.
- Confirm updated kernels are running after package or firmware installation.
- Review kernel logs and crash records for JFFS2 decompression or memory-corruption symptoms.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-57850 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/421f9e9f0fae9f8e721ffa07f22d9765fa1214d5CVE reference, Linux
- https://git.kernel.org/stable/c/f6fc251baefc3cdc4f41f2f5a47940d7d4a67332CVE reference, Linux
- https://git.kernel.org/stable/c/bd384b04ad1995441b18fe6c1366d02de8c5d5ebCVE reference, Linux
- https://git.kernel.org/stable/c/47c9a7f81027a78afea9d2e9a54bfd8fabb6b3d0CVE reference, Linux
- https://git.kernel.org/stable/c/6808a1812a3419542223e7fe9e2de577e99e45d1CVE reference, Linux
- https://git.kernel.org/stable/c/dc39b08fcc3831b0bc46add91ba93cd2aab50716CVE reference, Linux
- https://git.kernel.org/stable/c/fe051552f5078fa02d593847529a3884305a6ffeCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.