{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-40902", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-12T12:17:45.579Z", "datePublished": "2024-07-12T12:20:43.508Z", "dateUpdated": "2026-08-05T11:33:54.564Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:33:54.564Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: xattr: fix buffer overflow for invalid xattr\n\nWhen an xattr size is not what is expected, it is printed out to the\nkernel log in hex format as a form of debugging. But when that xattr\nsize is bigger than the expected size, printing it out can cause an\naccess off the end of the buffer.\n\nFix this all up by properly restricting the size of the debug hex dump\nin the kernel log." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - Triggering requires a locally attached/mounted crafted JFS image, and the OOB read is reached through ordinary local syscalls (getxattr/listxattr/stat) on files in that filesystem. No network or remote-peer data path exists into fs/jfs/xattr.c.\nAC:L - The attacker fully controls every input — the on-disk `di_ea.flag`, the 32-bit `di_ea.size`, and the 128 inline EA bytes — so setting `EALIST_SIZE(xattr) != ea_size` with a huge `ea_size` deterministically drives print_hex_dump past the buffer. No race, no memory-layout dependency, no non-default config (JFS xattr support is unconditional in fs/jfs).\nPR:L - Once the image is mounted, any unprivileged user can trigger it via getxattr/listxattr or merely a permission check through jfs_get_acl, and the only CAP_SYS_ADMIN check on the path (can_list) runs after ea_get returns. On desktop/kiosk deployments udisks2/polkit lets an unprivileged console user mount removable media containing the crafted JFS image.\nUI:N - The attacker mounts their own crafted image and then triggers the read themselves; no victim action is needed at any point. Auto-mount of removable media likewise requires no deliberate victim interaction.\nS:U - The out-of-bounds read stays within the kernel's own address space and security authority — no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is an unbounded slab out-of-bounds read (up to INT_MAX bytes from a 128-byte inline buffer) whose contents are hex-dumped verbatim to the kernel log, leaking adjacent heap objects, kernel pointers, and other tasks' data — far beyond a small bounded read.\nI:H - The attacker-sized dump writes tens of megabytes to gigabytes of hex output into the kernel log ring buffer, destroying all prior log and audit records; combined with the leaked heap pointers this undermines KASLR and the integrity of the system's forensic record.\nA:H - Reading hundreds of megabytes past the end of a slab object reliably walks into unmapped memory and oopses/panics the kernel, and even short of that the multi-gigabyte KERN_ERR flood renders the system unusable." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/jfs/xattr.c" ], "versions": [ { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "f0dedb5c511ed82cbaff4997a8decf2351ba549f", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "1e84c9b1838152a87cf453270a5fa75c5037e83a", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "fc745f6e83cb650f9a5f2c864158e3a5ea76dad0", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "480e5bc21f2c42d90c2c16045d64d824dcdd5ec7", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "33aecc5799c93d3ee02f853cb94e201f9731f123", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "4598233d9748fe4db4e13b9f473588aa25e87d69", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "b537cb2f4c4a1357479716a9c339c0bda03d873f", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "7c55b78818cfb732680c4a72ab270cc2d2ee3d0f", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/jfs/xattr.c" ], "versions": [ { "version": "2.6.12", "status": "affected" }, { "version": "0", "lessThan": "2.6.12", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.317", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.279", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.221", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.162", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.95", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.35", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.9.6", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "4.19.317" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "5.4.279" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "5.10.221" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "5.15.162" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.1.95" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.6.35" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.9.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.10" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/f0dedb5c511ed82cbaff4997a8decf2351ba549f" }, { "url": "https://git.kernel.org/stable/c/1e84c9b1838152a87cf453270a5fa75c5037e83a" }, { "url": "https://git.kernel.org/stable/c/fc745f6e83cb650f9a5f2c864158e3a5ea76dad0" }, { "url": "https://git.kernel.org/stable/c/480e5bc21f2c42d90c2c16045d64d824dcdd5ec7" }, { "url": "https://git.kernel.org/stable/c/33aecc5799c93d3ee02f853cb94e201f9731f123" }, { "url": "https://git.kernel.org/stable/c/4598233d9748fe4db4e13b9f473588aa25e87d69" }, { "url": "https://git.kernel.org/stable/c/b537cb2f4c4a1357479716a9c339c0bda03d873f" }, { "url": "https://git.kernel.org/stable/c/7c55b78818cfb732680c4a72ab270cc2d2ee3d0f" } ], "title": "jfs: xattr: fix buffer overflow for invalid xattr", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/f0dedb5c511ed82cbaff4997a8decf2351ba549f", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/1e84c9b1838152a87cf453270a5fa75c5037e83a", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/fc745f6e83cb650f9a5f2c864158e3a5ea76dad0", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/480e5bc21f2c42d90c2c16045d64d824dcdd5ec7", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/33aecc5799c93d3ee02f853cb94e201f9731f123", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/4598233d9748fe4db4e13b9f473588aa25e87d69", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/b537cb2f4c4a1357479716a9c339c0bda03d873f", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/7c55b78818cfb732680c4a72ab270cc2d2ee3d0f", "tags": [ "x_transferred" ] }, { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T21:57:30.293Z" } }, { "problemTypes": [ { "descriptions": [ { "type": "CWE", "cweId": "CWE-121", "lang": "en", "description": "CWE-121 Stack-based Buffer Overflow" } ] } ], "affected": [ { "vendor": "linux", "product": "linux_kernel", "cpes": [ "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "versions": [ { "version": "1da177e4c3f4", "status": "affected", "lessThan": "f0dedb5c511e", "versionType": "git" }, { "version": "1da177e4c3f4", "status": "affected", "lessThan": "1e84c9b18381", "versionType": "git" }, { "version": "1da177e4c3f4", "status": "affected", "lessThan": "fc745f6e83cb", "versionType": "git" }, { "version": "1da177e4c3f4", "status": "affected", "lessThan": "480e5bc21f2c", "versionType": "git" }, { "version": "1da177e4c3f4", "status": "affected", "lessThan": "33aecc5799c9", "versionType": "git" }, { "version": "1da177e4c3f4", "status": "affected", "lessThan": "4598233d9748", "versionType": "git" }, { "version": "1da177e4c3f4", "status": "affected", "lessThan": "b537cb2f4c4a", "versionType": "git" }, { "version": "1da177e4c3f4", "status": "affected", "lessThan": "7c55b78818cf", "versionType": "git" } ] } ], "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH" } }, { "other": { "type": "ssvc", "content": { "timestamp": "2024-08-16T04:02:10.264268Z", "id": "CVE-2024-40902", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-20T14:03:35.925Z" } } ] } }