CVE-2024-40951

What it actually does

NULL pointer dereference in ocfs2_abort_trigger() because bh->b_assoc_map is unset after bdev->bd_super removal, causing access to host->i_sb to fail when the ocfs2 journal abort path is exercised.

Why it matters to the business

Systems using the ocfs2 filesystem may experience kernel crashes or denial of service when journal abort handling occurs, requiring reboots and potentially disrupting clustered storage workloads until the kernel is updated.

How an attack unfolds

An attacker with local access mounts or interacts with an ocfs2 volume, triggers a journal abort condition that invokes ocfs2_abort_trigger(), and the missing b_assoc_map leads to a NULL dereference and kernel panic.

How to fix it

Update the Linux kernel to the fixed commit 67bcecd780609f471260a8c83fb0ae15f27734ce or later stable release containing the change that initializes all ocfs2 trigger types at fill_super time and retrieves the trigger via ocfs2_caching_info.

How to confirm the fix worked

Verify the running kernel contains commit 67bcecd780609f471260a8c83fb0ae15f27734ce, confirm ocfs2 triggers are initialized in fill_super, and test that journal abort paths no longer dereference NULL.

Typical attack path

1. Obtain local access to a system with ocfs2 filesystem mounted or mountable
2. Perform operations that cause journal abort handling in ocfs2
3. Trigger ocfs2_abort_trigger() via the uninitialized b_assoc_map path
4. Cause NULL pointer dereference resulting in kernel oops or panic

How to detect it

Inspect kernel logs for oops or panic messages referencing ocfs2_abort_trigger or NULL dereference in the ocfs2 journal abort path; correlate with ocfs2 filesystem mount and journal activity.

• ocfs2_abort_trigger
• b_assoc_map
• NULL pointer dereference in ocfs2

What your security team should do

• Apply the kernel fix containing commit 67bcecd780609f471260a8c83fb0ae15f27734ce as soon as possible on all systems using ocfs2
• Prioritize patching production clustered storage nodes first
• Monitor for ocfs2-related kernel crashes until patches are deployed