CVE-2024-41017

What it actually does

Missing bounds check when iterating extended attribute entries allows out-of-bounds memory access within the ealist structure during JFS extended attribute processing.

Why it matters to the business

Organizations running Linux with the JFS filesystem face elevated risk of kernel crashes, data corruption, or potential local code execution until systems are updated; the large number of downstream Linux distributions and embedded devices amplifies exposure.

How an attack unfolds

An attacker with local access crafts a malicious JFS filesystem image or extended attribute list that exceeds expected bounds; when the kernel parses the ealist without the added length check, memory outside the intended buffer is accessed, which could be leveraged for denial of service or further exploitation depending on attacker-controlled data.

How to fix it

Update the Linux kernel to a version containing commit 7f91bd0f2941fa36449ce1a15faaa64f840d9746 or later; rebuild and reboot affected systems; disable JFS if unused.

How to confirm the fix worked

Confirm the running kernel contains commit 7f91bd0f2941fa36449ce1a15faaa64f840d9746 via git log or kernel version string; test JFS extended attribute operations on crafted images to verify the bounds check prevents out-of-bounds access.

Typical attack path

1. Obtain local user access on a Linux system using JFS
2. Prepare a filesystem image or extended attribute payload that causes the ealist parser to walk past the end of allocated memory
3. Trigger the vulnerable code path through filesystem mount, file operations, or attribute manipulation
4. Achieve out-of-bounds read/write leading to crash or memory corruption for further exploitation

How to detect it

Review kernel logs for JFS extended attribute parsing errors or oops messages around ealist handling; examine filesystem images or user-controlled extended attributes for anomalous lengths; correlate with local user activity on JFS mounts.

What your security team should do

• Prioritize kernel updates on all systems using JFS within the next patching cycle
• Inventory Linux hosts and containers for JFS usage and schedule reboots
• Monitor for any new exploit code targeting this bounds-check omission