CVE-2024-39469

What it actually does

Incorrect error handling in nilfs_empty_dir() causes false empty directory determination on folio/page read failures or nilfs_check_folio() errors, leading to filesystem corruption; additionally, failure to return immediately on read errors enables long I/O loops when directory inode i_size is corrupted, potentially hanging the log writer thread.

Why it matters to the business

Systems relying on nilfs2 may experience filesystem corruption resulting in data loss or inconsistency, along with potential hangs that disrupt operations; low prevalence in modern deployments and lack of known exploitation reduce immediate risk, though unpatched kernels remain exposed to I/O-induced issues.

How an attack unfolds

An attacker with ability to induce I/O errors (such as through crafted filesystem images or hardware faults) can trigger the misjudgment in nilfs_empty_dir(), causing the kernel to treat a non-empty directory as empty and corrupt metadata; prolonged loops may also stall the log writer, as noted in syzbot reports, though no specific threat actor campaigns have been tied to this flaw.

How to fix it

Upgrade the Linux kernel to include commit 2ac8a2fe22bdde9eecce2a42cf5cab79333fb428 or later stable releases that contain the fix; rebuild and deploy updated kernel images on affected systems using nilfs2.

How to confirm the fix worked

Verify the running kernel contains commit 2ac8a2fe22bdde9eecce2a42cf5cab79333fb428 by checking /proc/version or git log; test nilfs_empty_dir() behavior under simulated I/O error conditions to confirm immediate false return.

Typical attack path

1. Cause a directory folio/page read failure via corrupted or malicious filesystem state
2. nilfs_empty_dir() fails to handle error and incorrectly returns 0 (empty)
3. Kernel proceeds with operations assuming empty directory, corrupting filesystem structures
4. If i_size is also corrupted, enter extended loop consuming I/O resources and hanging log writer

How to detect it

Review kernel logs for nilfs2 I/O error messages around directory operations and log writer thread stalls; inspect for unexpected filesystem corruption reports following directory access attempts.

What your security team should do

• Apply the referenced kernel commit or newer stable version immediately on any nilfs2 deployments
• Monitor for filesystem errors and log writer hangs in systems using nilfs2
• Consider disabling nilfs2 if not required until patching is complete