CVE-2024-49902

What it actually does

Out-of-bounds access in JFS dbSplit triggered when dmt_leafidx exceeds the number of leaves per dmap tree due to missing validation in dbFindLeaf for both leaf and control pages.

Why it matters to the business

Local denial of service or system instability on Linux deployments using the JFS filesystem; low EPSS and no KEV listing reduce immediate ransomware urgency but Linux kernel prevalence still requires attention.

How an attack unfolds

An attacker with local access triggers the unvalidated dmt_leafidx condition during dmap tree operations in dbFindLeaf leading to out-of-bounds in dbSplit; listed threat actors reference generic Linux kernel OOB and uninitialized resource campaigns but no specific named APT exploitation is tied to this CVE.

How to fix it

Apply the upstream kernel fix adding the dmt_leafidx sanity check to dbFindLeaf for leaf and control pages; no rdoc packages are involved despite erroneous listing.

How to confirm the fix worked

Confirm the check for dmt_leafidx against num leaves per dmap tree exists in dbFindLeaf and test with crafted JFS dmap structures that previously caused OOB.

Typical attack path

1. Obtain local access on a Linux system with JFS
2. Interact with JFS filesystem structures to reach dbFindLeaf
3. Supply or induce a dmt_leafidx value exceeding valid leaf count
4. Trigger dbSplit with the invalid index causing out-of-bounds access

How to detect it

Review kernel logs for JFS dmap tree errors or oops reports around dbSplit and dbFindLeaf; no specific threat actor IOCs are available for this resolved issue.

What your security team should do

• Prioritize kernel updates containing the JFS dbFindLeaf patch on all systems using JFS
• Audit for JFS usage in production workloads given 721 days since publication
• Monitor EPSS trend stability and re-evaluate if new exploitation appears