CVE-2024-40902

What it actually does

The flaw permits an out-of-bounds read during a hex dump of an oversized JFS xattr value in kernel debug logging when the reported size exceeds the allocated buffer.

Why it matters to the business

Local attackers on affected Linux systems using JFS may trigger kernel crashes or memory corruption, risking denial of service or privilege escalation on servers and endpoints; low EPSS and no KEV status indicate limited immediate widespread risk despite kernel prevalence.

How an attack unfolds

An attacker with local access supplies a malformed extended attribute on a JFS filesystem that reports an unexpectedly large size, causing the kernel debug path to perform an unbounded hex dump and overflow the buffer; listed threat actors in espionage and ransomware campaigns could chain this with other kernel issues for code execution.

How to fix it

Upgrade the Linux kernel to the fixed commit f0dedb5c511ed82cbaff4997a8decf2351ba549f or apply the corresponding stable backport; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Verify the running kernel contains commit f0dedb5c511ed82cbaff4997a8decf2351ba549f via git log or uname; test by attempting to trigger the xattr debug path with oversized values and confirm no overflow occurs.

Typical attack path

1. Gain local user access to a Linux system using JFS
2. Create or modify an xattr with an invalid oversized value
3. Trigger the xattr debug logging path in the kernel
4. Exploit the resulting buffer overflow for memory corruption or crash

How to detect it

Review kernel logs for JFS xattr hex dump entries showing sizes larger than expected; inspect for related oops or panic traces mentioning xattr buffer handling.

What your security team should do

• Prioritize kernel updates on all JFS-using systems within standard patch windows
• Restrict untrusted local accounts until patches are applied
• Monitor kernel mailing lists for related JFS xattr fixes