CVE-2024-26871
"F2FS Null Pointer Dereference"
Description
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix NULL pointer dereference in f2fs_submit_page_write() BUG: kernel NULL pointer dereference, address: 0000000000000014 RIP: 0010:f2fs_submit_page_write+0x6cf/0x780 [f2fs] Call Trace: <TASK> ? show_regs+0x6e/0x80 ? __die+0x29/0x70 ? page_fault_oops+0x154/0x4a0 ? prb_read_valid+0x20/0x30 ? __irq_work_queue_local+0x39/0xd0 ? irq_work_queue+0x36/0x70 ? do_user_addr_fault+0x314/0x6c0 ? exc_page_fault+0x7d/0x190 ? asm_exc_page_fault+0x2b/0x30 ? f2fs_submit_page_write+0x6cf/0x780 [f2fs] ? f2fs_submit_page_write+0x736/0x780 [f2fs] do_write_page+0x50/0x170 [f2fs] f2fs_outplace_write_data+0x61/0xb0 [f2fs] f2fs_do_write_data_page+0x3f8/0x660 [f2fs] f2fs_write_single_data_page+0x5bb/0x7a0 [f2fs] f2fs_write_cache_pages+0x3da/0xbe0 [f2fs] ... It is possible that other threads have added this fio to io->bio and submitted the io->bio before entering f2fs_submit_page_write(). At this point io->bio = NULL. If is_end_zone_blkaddr(sbi, fio->new_blkaddr) of this fio is true, then an NULL pointer dereference error occurs at bio_get(io->bio). The original code for determining zone end was after "out:", which would have missed some fio who is zone end. I've moved this code before "skip:" to make sure it's done for each fio.
INFO
Published Date :
April 17, 2024, 11:15 a.m.
Last Modified :
Jan. 14, 2025, 2:46 p.m.
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Remotely Exploitable :
No
Impact Score :
3.6
Exploitability Score :
1.8
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-26871.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-26871 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2024-26871 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Jan. 14, 2025
Action Type Old Value New Value Added CVSS V3.1 NIST AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE NIST CWE-476 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.5 up to (excluding) 6.6.23 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.7.11 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.8 up to (excluding) 6.8.2 Changed Reference Type https://git.kernel.org/stable/c/4c122a32582b67bdd44ca8d25f894ee2dc54f566 No Types Assigned https://git.kernel.org/stable/c/4c122a32582b67bdd44ca8d25f894ee2dc54f566 Patch Changed Reference Type https://git.kernel.org/stable/c/4c122a32582b67bdd44ca8d25f894ee2dc54f566 No Types Assigned https://git.kernel.org/stable/c/4c122a32582b67bdd44ca8d25f894ee2dc54f566 Patch Changed Reference Type https://git.kernel.org/stable/c/6d102382a11d5e6035f6c98f6e508a38541f7af3 No Types Assigned https://git.kernel.org/stable/c/6d102382a11d5e6035f6c98f6e508a38541f7af3 Patch Changed Reference Type https://git.kernel.org/stable/c/6d102382a11d5e6035f6c98f6e508a38541f7af3 No Types Assigned https://git.kernel.org/stable/c/6d102382a11d5e6035f6c98f6e508a38541f7af3 Patch Changed Reference Type https://git.kernel.org/stable/c/8e2ea8b04cb8d976110c4568509e67d6a39b2889 No Types Assigned https://git.kernel.org/stable/c/8e2ea8b04cb8d976110c4568509e67d6a39b2889 Patch Changed Reference Type https://git.kernel.org/stable/c/8e2ea8b04cb8d976110c4568509e67d6a39b2889 No Types Assigned https://git.kernel.org/stable/c/8e2ea8b04cb8d976110c4568509e67d6a39b2889 Patch Changed Reference Type https://git.kernel.org/stable/c/c2034ef6192a65a986a45c2aa2ed05824fdc0e9f No Types Assigned https://git.kernel.org/stable/c/c2034ef6192a65a986a45c2aa2ed05824fdc0e9f Patch Changed Reference Type https://git.kernel.org/stable/c/c2034ef6192a65a986a45c2aa2ed05824fdc0e9f No Types Assigned https://git.kernel.org/stable/c/c2034ef6192a65a986a45c2aa2ed05824fdc0e9f Patch -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 21, 2024
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/4c122a32582b67bdd44ca8d25f894ee2dc54f566 Added Reference https://git.kernel.org/stable/c/6d102382a11d5e6035f6c98f6e508a38541f7af3 Added Reference https://git.kernel.org/stable/c/8e2ea8b04cb8d976110c4568509e67d6a39b2889 Added Reference https://git.kernel.org/stable/c/c2034ef6192a65a986a45c2aa2ed05824fdc0e9f -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 29, 2024
Action Type Old Value New Value -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 14, 2024
Action Type Old Value New Value -
CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Apr. 17, 2024
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: f2fs: fix NULL pointer dereference in f2fs_submit_page_write() BUG: kernel NULL pointer dereference, address: 0000000000000014 RIP: 0010:f2fs_submit_page_write+0x6cf/0x780 [f2fs] Call Trace: <TASK> ? show_regs+0x6e/0x80 ? __die+0x29/0x70 ? page_fault_oops+0x154/0x4a0 ? prb_read_valid+0x20/0x30 ? __irq_work_queue_local+0x39/0xd0 ? irq_work_queue+0x36/0x70 ? do_user_addr_fault+0x314/0x6c0 ? exc_page_fault+0x7d/0x190 ? asm_exc_page_fault+0x2b/0x30 ? f2fs_submit_page_write+0x6cf/0x780 [f2fs] ? f2fs_submit_page_write+0x736/0x780 [f2fs] do_write_page+0x50/0x170 [f2fs] f2fs_outplace_write_data+0x61/0xb0 [f2fs] f2fs_do_write_data_page+0x3f8/0x660 [f2fs] f2fs_write_single_data_page+0x5bb/0x7a0 [f2fs] f2fs_write_cache_pages+0x3da/0xbe0 [f2fs] ... It is possible that other threads have added this fio to io->bio and submitted the io->bio before entering f2fs_submit_page_write(). At this point io->bio = NULL. If is_end_zone_blkaddr(sbi, fio->new_blkaddr) of this fio is true, then an NULL pointer dereference error occurs at bio_get(io->bio). The original code for determining zone end was after "out:", which would have missed some fio who is zone end. I've moved this code before "skip:" to make sure it's done for each fio. Added Reference kernel.org https://git.kernel.org/stable/c/8e2ea8b04cb8d976110c4568509e67d6a39b2889 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/4c122a32582b67bdd44ca8d25f894ee2dc54f566 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/6d102382a11d5e6035f6c98f6e508a38541f7af3 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/c2034ef6192a65a986a45c2aa2ed05824fdc0e9f [No types assigned]
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-26871 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-26871
weaknesses.