CVE-2024-49900

What it actually does

Uninitialized memory in ea_buf->new_ea is passed to compression routines during xattr handling in the JFS filesystem, allowing kernel use of uninitialized values.

Why it matters to the business

Systems running affected kernels with JFS may experience crashes or limited information disclosure when extended attributes are set, increasing operational risk on Linux servers or devices using this filesystem; high ecosystem prevalence amplifies exposure across many deployments.

How an attack unfolds

A local attacker creates or modifies extended attributes on a JFS filesystem to reach the uninitialized path in ea_get, triggering the uninit-value use in lzo1x compression; listed threat actors in 2024 zero-day and Linux kernel campaigns could leverage similar uninitialized resource flaws for local impact.

How to fix it

Apply the upstream kernel fix that adds memset to clear new_ea at the start of ea_get; for listed carrierwave packages upgrade to 2.1.1 or 1.3.2 as appropriate.

How to confirm the fix worked

Confirm the memset initialization is present in ea_get() in the running kernel source or verify updated packages are installed; test xattr operations on JFS mounts.

Typical attack path

1. Obtain local access on a system using JFS
2. Invoke __jfs_setxattr or related xattr operations
3. Trigger ea_get without proper initialization of new_ea
4. Cause use of uninit value in lzo1x_1_do_compress

How to detect it

Review kernel logs for KMSAN or uninit-value reports involving lzo1x_1_do_compress and ea_get; inspect call traces from fs/jfs/xattr.c.

What your security team should do

• Prioritize kernel updates on all JFS-using systems due to memory corruption risk
• Monitor for local privilege or stability issues involving xattrs
• Review filesystem usage and migrate off JFS where feasible