CVE-2024-42104

What it actually does

Missing sanity checks on inode numbers in nilfs2 directory entries allow corrupted filesystem images to reference internal metadata inodes, causing their link counts to reach zero and triggering use-after-free in nilfs_evict_inode during iput when the filesystem is mounted and unmounted.

Why it matters to the business

Systems running affected Linux kernels can experience kernel panics or crashes when mounting attacker-supplied corrupted nilfs2 images, leading to denial of service and potential local privilege escalation in environments that process untrusted filesystems.

How an attack unfolds

An attacker creates a specially crafted nilfs2 filesystem image containing directory entries that point to normally invisible metadata file inodes, mounts the image on a vulnerable kernel to corrupt inode link counts to zero, and unmounts it to force eviction and trigger the use-after-free in lru_add_fn.

How to fix it

Update the Linux kernel to a version containing commit c33c2b0d92aa1c2262d999b2598ad6fbd53bd479 or later stable releases that enforce inode number validation for nilfs2 directory entries.

How to confirm the fix worked

Confirm the kernel source contains the sanity check helper that rejects internal metadata inode numbers when reading directory folios, and test by attempting to mount known-bad nilfs2 images without triggering the use-after-free.

Typical attack path

1. Craft a nilfs2 filesystem image with directory entries referencing internal metadata inodes
2. Supply the image to a target system for mounting
3. Mount the image to read the malformed directory pages without inode validation
4. Unmount the image to invoke iput and nilfs_evict_inode on the corrupted inode
5. Trigger the use-after-free during LRU operations

How to detect it

Review kernel logs for oops traces referencing nilfs2 directory reading, inode eviction, and lru_add_fn; inspect mount attempts of nilfs2 volumes from untrusted sources.

What your security team should do

• Apply the kernel patch containing commit c33c2b0d92aa1c2262d999b2598ad6fbd53bd479 immediately on all systems using nilfs2
• Disable nilfs2 filesystem support via kernel configuration if the feature is not required
• Monitor for kernel oops or panic reports involving nilfs_evict_inode and lru_add_fn