CVE-2024-57850
Published: 11 January 2025
Description
In the Linux kernel, the following vulnerability has been resolved: jffs2: Prevent rtime decompress memory corruption The rtime decompression routine does not fully check bounds during the entirety of the decompression pass and can corrupt memory outside the decompression buffer if the compressed data is corrupted. This adds the required check to prevent this failure mode.
Security Summary
CVE-2024-57850 is a vulnerability in the Linux kernel's JFFS2 filesystem implementation, specifically in the rtime decompression routine. This routine fails to perform complete bounds checking throughout the decompression process, allowing memory corruption outside the intended decompression buffer when processing corrupted compressed data. The issue is classified under CWE-787 (Out-of-bounds Write) and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant confidentiality, integrity, and availability impacts.
A local attacker with low privileges can exploit this vulnerability by supplying malformed compressed data to the JFFS2 rtime decompressor, such as through a crafted filesystem image or file. Successful exploitation leads to out-of-bounds memory writes, which could enable arbitrary code execution, privilege escalation, or system crashes, depending on the attacker's control over the corrupted data and the kernel's memory layout.
Mitigation is provided through patches in Linux kernel stable releases, as detailed in the referenced commits: 421f9e9f0fae9f8e721ffa07f22d9765fa1214d5, 47c9a7f81027a78afea9d2e9a54bfd8fabb6b3d0, 6808a1812a3419542223e7fe9e2de577e99e45d1, bd384b04ad1995441b18fe6c1366d02de8c5d5eb, and dc39b08fcc3831b0bc46add91ba93cd2aab50716. These commits add the necessary bounds checks to prevent memory corruption during decompression. Security practitioners should update affected kernel versions to incorporate these fixes.
Details
- CWE(s)