CVE-2024-47757

What it actually does

Potential out-of-bounds read in nilfs_btree_check_delete() when retrieving the maximum key from an empty b-tree root node, accessing memory outside the block buffer.

Why it matters to the business

May lead to kernel instability, crashes, or limited information disclosure on affected Linux systems using nilfs2; low operational urgency given stable low EPSS, no KEV status, and over 700 days since publication despite mentions in various threat reports.

How an attack unfolds

An attacker crafts a malicious nilfs2 filesystem image with a b-tree root node containing zero entries, then causes the target system to read or mount the image, triggering the unchecked access in nilfs_btree_check_delete(); referenced in reports of Linux kernel OOB read campaigns by espionage and financially motivated actors.

How to fix it

Apply kernel patches resolving the nilfs2 b-tree check; for environments referencing nokogiri (RubyGems) update to version 1.10.8.

How to confirm the fix worked

Confirm kernel source includes the added check for zero-entry root nodes in nilfs_btree_check_delete(); test with crafted empty-root images to verify no OOB access occurs.

Typical attack path

1. Construct a nilfs2 filesystem image with malformed empty b-tree root node
2. Deliver the image to the target environment
3. Induce the kernel to perform b-tree operations such as mounting or deletion checks
4. Trigger out-of-bounds memory read

How to detect it

Review kernel logs for nilfs2 b-tree related faults or panics; inspect mount operations on potentially untrusted volumes; correlate with threat actor mentions of Linux kernel OOB read activity.

What your security team should do

• Prioritize patching nilfs2 systems in environments with untrusted filesystem images
• Monitor EPSS trend and threat actor reports for any increase in exploitation
• Audit nilfs2 usage across the fleet given ecosystem prevalence indicators