CVE-2024-47699

What it actually does

Null pointer dereference in nilfs_btree_insert when a corrupted nilfs2 b-tree root node has height greater than 2 but zero child nodes, because nilfs_btree_do_lookup leaves path[x].bp_bh NULL and nilfs_btree_get_nonroot_node then dereferences it.

Why it matters to the business

Local users on systems using the nilfs2 filesystem can trigger a kernel crash or denial of service by presenting a specially crafted corrupted filesystem image, leading to unplanned downtime and potential data unavailability.

How an attack unfolds

An attacker with local access prepares or obtains a nilfs2 filesystem image containing a malformed b-tree root node (height > 2 and zero children), mounts it, and performs an operation that calls nilfs_btree_insert, causing the kernel to dereference a NULL buffer head and panic.

How to fix it

Update the Linux kernel to a version containing the fix that strengthens nilfs_btree_root_broken sanity checks. Reboot after applying the kernel update. For roundup (PyPI) deployments, upgrade to version 2.4.0.

How to confirm the fix worked

Verify the kernel contains the nilfs2 b-tree root broken check patch; attempt to mount a test image that previously triggered the NULL dereference and confirm the mount fails gracefully or the system remains stable.

Typical attack path

1. Obtain or craft a nilfs2 filesystem image with an inconsistent b-tree root node
2. Gain local user access on a Linux system
3. Mount the malicious filesystem image
4. Trigger nilfs_btree_insert via normal filesystem operations
5. Kernel panics due to NULL pointer dereference

How to detect it

Review kernel logs for oops or panic messages containing nilfs_btree_prepare_insert or nilfs_btree_insert after a nilfs2 mount attempt; look for filesystem images that fail mount with b-tree inconsistency warnings.

What your security team should do

• Prioritize kernel updates on all systems using nilfs2
• Restrict local user ability to mount untrusted filesystem images until patched
• Monitor for kernel oops or panic logs referencing nilfs_btree
• Apply the roundup (PyPI) 2.4.0 update if that package is in use