CVE-2024-39472

What it actually does

Out-of-bounds memory access in XFS log recovery buffer allocation when an invalid h_size value not originating from legacy mkfs is used, bypassing the fixed-up size calculation.

Why it matters to the business

Linux systems using XFS filesystems can experience crashes or instability during log recovery, leading to potential downtime and loss of access to affected filesystems until patched.

How an attack unfolds

An attacker with local access supplies a malformed XFS filesystem image containing an invalid h_size during log recovery; the kernel allocates a recovery buffer using the unfixed size, resulting in out-of-bounds access. Threat actors in espionage and financially motivated campaigns have targeted similar Linux kernel memory issues.

How to fix it

Upgrade affected packages to the listed fixed versions: gstreamer/gstreamer (GIT) to ddb4fbe43149b157efb52b6472313f48308c1dbc, gst-plugins-bad1.0 (Debian:11) to 1.18.4-3+deb11u2, gst-plugins-bad1.0 (Debian:12) to 1.22.0-4+deb12u2, gst-plugins-bad1.0 (Debian:13) to 1.22.7-1. Apply kernel patches addressing XFS log recovery buffer sizing.

How to confirm the fix worked

Verify kernel or package versions match the fixed releases and test log recovery with previously triggering malformed images to confirm absence of OOB access.

Typical attack path

1. Obtain local user access on a target Linux system
2. Prepare or obtain a malicious XFS image with crafted h_size
3. Trigger filesystem mount or log recovery operation
4. Cause out-of-bounds access during buffer allocation

How to detect it

Review kernel logs for XFS log recovery errors or buffer allocation failures; examine crash dumps for references to invalid iclog sizes or out-of-bounds writes during mount operations.

What your security team should do

• Prioritize patching systems with XFS filesystems within the next maintenance window due to memory corruption risk
• Monitor for kernel oops or panic reports involving xlog_logrec_hblks or log recovery
• Restrict untrusted filesystem images on multi-user systems