PT-2024-10457 · Linux+5 · Linux Kernel+5
Wang Yong
·
Published
2024-07-30
·
Updated
2025-02-03
·
CVE-2024-42115
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.43
Description
A vulnerability in the Linux kernel's jffs2 file system has been resolved. The issue was related to a potential illegal address access in the jffs2 free inode function. During stress testing, abnormal printouts were found, indicating a kernel paging request error at a virtual address. The error was caused by the destroy inode process being triggered in the iget locked function, which released the inode and consequently did not initialize the target member of the inode. The fix method is to set the target to NULL in the jffs2 i init once function.
Recommendations
To resolve the issue, update the Linux kernel to version 6.6.43 or later. As a temporary workaround, consider disabling the jffs2 file system until a patch is available. However, since the fix is to set the target to NULL in the jffs2 i init once function, applying this patch or updating to a version that includes this fix is the recommended resolution.
Exploit
Fix
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu