{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-46781", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-09-11T15:12:18.276Z", "datePublished": "2024-09-18T07:12:37.603Z", "dateUpdated": "2026-08-05T11:38:32.082Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:38:32.082Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix missing cleanup on rollforward recovery error\n\nIn an error injection test of a routine for mount-time recovery, KASAN\nfound a use-after-free bug.\n\nIt turned out that if data recovery was performed using partial logs\ncreated by dsync writes, but an error occurred before starting the log\nwriter to create a recovered checkpoint, the inodes whose data had been\nrecovered were left in the ns_dirty_files list of the nilfs object and\nwere not freed.\n\nFix this issue by cleaning up inodes that have read the recovery data if\nthe recovery routine fails midway before the log writer starts." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The bug is reached only through `mount()` of an attacker-crafted nilfs2 block device/image, i.e. local system access; there is no network-facing path into `load_nilfs()`/`nilfs_salvage_orphan_logs()`.\nAC:L - The failure is deterministically driven by the on-disk log layout — a valid dsync log group that dirties inodes followed by a segment with `NILFS_SS_SR` set forces `goto confused`/`-EINVAL` after `ns_dirty_files` is populated — with no race or environmental condition outside the attacker's control.\nPR:L - In the most severe realistic deployment (desktop/kiosk/embedded systems with udisks2 or autofs auto-mounting removable media, or fstab `user` mounts), an unprivileged local actor supplies the image and the mount happens on their behalf without any elevated credentials of their own.\nUI:N - The attacker performs or triggers the mount themselves (inserting their own media on a shared/kiosk machine or invoking a permitted mount); no action by a separate victim user is needed.\nS:U - The corruption is confined to kernel memory managed by the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The leaked inodes retain dangling pointers to the freed `nilfs_root`, `the_nilfs` and `super_block`; reclaiming those kmalloc objects with attacker-sprayed data and then touching the stale inodes yields type-confused reads of kernel memory, so full confidentiality loss is achievable.\nI:H - The same use-after-free provides a write side — writeback of the leaked dirty folios and `nilfs_evict_inode()`/`nilfs_put_root()` paths dereference and mutate the freed structures, giving heap-spray-controlled write primitives usable for control-flow hijack.\nA:H - Even unweaponized, the dangling `i_sb`/`i_root`/`s_fs_info` references and the busy-inode leak reliably produce a kernel oops or panic during or after the failed mount." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/nilfs2/recovery.c" ], "versions": [ { "version": "0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b", "lessThan": "35a9a7a7d94662146396199b0cfd95f9517cdd14", "status": "affected", "versionType": "git" }, { "version": "0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b", "lessThan": "da02f9eb333333b2e4f25d2a14967cff785ac82e", "status": "affected", "versionType": "git" }, { "version": "0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b", "lessThan": "07e4dc2fe000ab008bcfe90be4324ef56b5b4355", "status": "affected", "versionType": "git" }, { "version": "0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b", "lessThan": "8e2d1e9d93c4ec51354229361ac3373058529ec4", "status": "affected", "versionType": "git" }, { "version": "0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b", "lessThan": "ca92c4bff2833cb30d493b935168d6cccd5c805d", "status": "affected", "versionType": "git" }, { "version": "0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b", "lessThan": "9d8c3a585d564d776ee60d4aabec59b404be7403", "status": "affected", "versionType": "git" }, { "version": "0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b", "lessThan": "1cf1f7e8cd47244fa947d357ef1f642d91e219a3", "status": "affected", "versionType": "git" }, { "version": "0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b", "lessThan": "5787fcaab9eb5930f5378d6a1dd03d916d146622", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/nilfs2/recovery.c" ], "versions": [ { "version": "2.6.30", "status": "affected" }, { "version": "0", "lessThan": "2.6.30", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.322", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.284", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.226", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.167", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.110", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.51", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.10", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "4.19.322" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "5.4.284" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "5.10.226" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "5.15.167" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "6.1.110" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "6.6.51" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "6.10.10" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "6.11" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/35a9a7a7d94662146396199b0cfd95f9517cdd14" }, { "url": "https://git.kernel.org/stable/c/da02f9eb333333b2e4f25d2a14967cff785ac82e" }, { "url": "https://git.kernel.org/stable/c/07e4dc2fe000ab008bcfe90be4324ef56b5b4355" }, { "url": "https://git.kernel.org/stable/c/8e2d1e9d93c4ec51354229361ac3373058529ec4" }, { "url": "https://git.kernel.org/stable/c/ca92c4bff2833cb30d493b935168d6cccd5c805d" }, { "url": "https://git.kernel.org/stable/c/9d8c3a585d564d776ee60d4aabec59b404be7403" }, { "url": "https://git.kernel.org/stable/c/1cf1f7e8cd47244fa947d357ef1f642d91e219a3" }, { "url": "https://git.kernel.org/stable/c/5787fcaab9eb5930f5378d6a1dd03d916d146622" } ], "title": "nilfs2: fix missing cleanup on rollforward recovery error", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2024-09-29T14:37:59.673853Z", "id": "CVE-2024-46781", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-29T14:38:14.597Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:18:23.818Z" } } ] } }