CVE-2024-41034

What it actually does

Improper input validation in nilfs_dotdot() allows directory entry lookups on corrupted nilfs2 structures to return offsets exceeding folio/page boundaries, triggering BUG_ON during __block_write_begin_int() on rename operations.

Why it matters to the business

Systems using the nilfs2 filesystem may experience unexpected kernel crashes or panics when rename operations are performed on directories with certain corruption patterns, leading to potential service disruption and requiring manual recovery.

How an attack unfolds

An attacker with the ability to create or supply a maliciously corrupted nilfs2 filesystem image triggers a directory rename operation; nilfs_dotdot() fails to validate the '.' and '..' entries within the first directory chunk, returning an out-of-bounds location that causes the kernel BUG_ON check to fire during block write preparation.

How to fix it

Update the Linux kernel to a version containing commit ff9767ba2cb949701e45e6e4287f8af82986b703 or later; rebuild and reboot with the patched kernel. For systems that cannot immediately update, avoid mounting untrusted nilfs2 images and restrict rename operations on potentially corrupted volumes.

How to confirm the fix worked

Verify the running kernel contains commit ff9767ba2cb949701e45e6e4287f8af82986b703 via 'git log' or package version checks; attempt rename operations on test directories with deliberately truncated '.'/'..' entries and confirm absence of BUG_ON panics.

Typical attack path

1. Obtain or craft a nilfs2 filesystem containing a directory whose first chunk lacks valid '.' or '..' entries
2. Mount the filesystem on a vulnerable kernel
3. Perform a rename operation that invokes nilfs_dotdot() on the broken directory
4. Trigger __block_write_begin_int() which hits the page-size assertion

How to detect it

Inspect kernel logs (dmesg, /var/log/kern.log, journalctl) for BUG_ON assertions mentioning __block_write_begin_int and nilfs2; search for nilfs_dotdot calls followed by page-size violation reports; correlate with mount or rename activity on nilfs2 volumes.

• BUG_ON.*__block_write_begin_int
• nilfs_dotdot
• nilfs2.*rename.*broken directory

What your security team should do

• Prioritize kernel updates on any system exposing nilfs2 volumes to untrusted data
• Monitor for kernel oops and BUG_ON messages referencing nilfs2 and __block_write_begin_int
• Apply the fix commit ff9767ba2cb949701e45e6e4287f8af82986b703 across stable branches
• Review backup and recovery procedures for nilfs2 filesystems in case of corruption-induced crashes