CVE-2024-46688

What it actually does

Out-of-bounds access or null pointer dereference in erofs z_erofs_gbuf_growsize() when a global buffer growth partially fails due to allocation error, because the existing pages array size is not validated before access.

Why it matters to the business

Kernel crashes or potential privilege escalation on Linux systems using the erofs filesystem, leading to downtime, data corruption risk, and the need for urgent patching across server fleets and embedded devices.

How an attack unfolds

An attacker with local access triggers memory allocation failure or fault injection during erofs buffer resizing; the missing bounds check on gbuf->nrpages then allows out-of-bounds reads or writes, which can be turned into code execution or denial of service.

How to fix it

Upgrade the Linux kernel to version 6.10.8 or later, or apply the fix from commit 49c0e081998008cde0c872c0ff9affa1ece4b878 in the stable tree; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the running kernel contains the referenced commit or is at least 6.10.8; test erofs mount and buffer growth paths under memory pressure to ensure no crashes occur.

Typical attack path

1. Obtain local code execution on a Linux host using erofs
2. Force partial failure of z_erofs_gbuf_growsize via allocation pressure or fault injection
3. Trigger access to the undersized gbuf->pages array
4. Achieve out-of-bounds read/write or null dereference
5. Escalate to kernel code execution or cause system panic

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for oops, BUG, or warning messages referencing erofs, z_erofs_gbuf_growsize, or gbuf pages array access around the time of suspected exploitation.

• z_erofs_gbuf_growsize
• gbuf->nrpages
• erofs out-of-bound access

What your security team should do

• Immediately schedule kernel upgrades to 6.10.8+ on all erofs-using systems
• Prioritize patching of internet-facing or high-value Linux servers
• Monitor kernel logs for erofs-related oops or page faults until patches are deployed
• Disable erofs mounts where the filesystem is not required