CVE-2024-35948

What it actually does

Missing bounds check in bcachefs superblock validation allows journal entries to overrun the end of the sb clean section, leading to out-of-bounds memory access during filesystem mount or load.

Why it matters to the business

Systems using the bcachefs filesystem face risk of kernel crashes, data corruption, or potential local code execution, disrupting operations on Linux servers and devices until kernels are updated.

How an attack unfolds

An attacker prepares a malicious bcachefs filesystem image containing oversized journal entries that exceed the superblock clean section, then causes the target system to mount or validate the image, triggering the missing bounds check and resulting memory corruption.

How to fix it

Upgrade affected Linux kernels to versions containing the fix in commits a38297e3fb012ddfa7ce0321a7e5a8daeb1872b6 or fcdbc1d7a4b638e5d5668de461f320386f3002aa; rebuild and deploy updated kernels across all systems using bcachefs.

How to confirm the fix worked

Verify kernel source or binary includes the bounds check commit; test by attempting to mount a crafted superblock image and confirm validation rejects oversized entries without overrun.

Typical attack path

1. Craft a malicious bcachefs superblock image with journal entries that overrun the clean section bounds
2. Make the image accessible to the target system via local media or network share
3. Trigger superblock validation by attempting to mount the filesystem or during kernel boot with bcachefs
4. Exploit resulting out-of-bounds access for crash, corruption, or code execution

How to detect it

Review kernel logs for bcachefs superblock validation errors or oops messages during mount attempts; inspect system boot logs and dmesg for anomalies related to journal entry processing.

What your security team should do

• Immediately identify and prioritize patching of all Linux systems with bcachefs enabled
• Apply fixed kernel versions from the listed commits as soon as available in distributions
• Disable bcachefs modules on systems where not required until patched
• Monitor for kernel updates and schedule testing in non-production environments first