CVE-2024-49877

What it actually does

NULL pointer dereference in ocfs2_set_buffer_uptodate when a buffer head is NULL during cleanup if OCFS2_BH_READAHEAD flag is absent, causing kernel crash in the ocfs2 filesystem code.

Why it matters to the business

Potential denial of service on Linux systems using the ocfs2 filesystem, leading to unplanned downtime or system instability; low exploitation likelihood but requires prompt patching on affected kernels to avoid operational disruption, especially given listed threat actor interest in similar kernel issues.

How an attack unfolds

An attacker with local access or the ability to trigger ocfs2 buffer operations crafts conditions during cleanup where the buffer head is NULL without the readahead flag, causing the kernel to dereference a null pointer and panic; listed threat actors in zero-day and kernel resource/access campaigns could adapt similar patterns for targeted Linux environments.

How to fix it

Update Linux kernel to fixed version 4.19.323 or later; for any nokogiri dependencies update to 1.13.2.

How to confirm the fix worked

Verify running kernel version is at or above 4.19.323; test ocfs2 buffer operations under cleanup scenarios to confirm absence of null dereference.

Typical attack path

1. Gain local execution or trigger filesystem operations on ocfs2
2. Manipulate buffer states to enter cleanup path without OCFS2_BH_READAHEAD
3. Pass NULL buffer head to ocfs2_set_buffer_uptodate
4. Trigger NULL pointer dereference leading to kernel panic

How to detect it

Review kernel logs for oops or panic messages referencing ocfs2_set_buffer_uptodate or null pointer dereference during buffer operations; correlate with ocfs2 filesystem activity.

What your security team should do

• Prioritize kernel upgrade to 4.19.323 on all ocfs2-using systems
• Monitor EPSS and threat actor reports for any increase in activity
• Apply updates within standard patch windows given low EPSS and non-KEV status
• Review filesystem configurations to minimize exposure