CVE-2024-49957

What it actually does

Null pointer dereference in ocfs2 journal shutdown when jbd2_journal_load fails due to short journal, because JBD2_LOADED flag is not checked before accessing journal->j_sb_buffer in the tail update path.

Why it matters to the business

Unexpected system crashes or kernel panics during mount of OCFS2 filesystems on Linux, causing downtime and loss of access to clustered storage in affected environments.

How an attack unfolds

An attacker with local access supplies a malformed or truncated OCFS2 filesystem image that causes journal_reset to fail inside jbd2_journal_load; subsequent ocfs2_journal_shutdown then dereferences a NULL j_sb_buffer while flushing the journal, triggering a kernel panic. General Linux kernel exploitation campaigns by espionage and financially motivated actors have targeted similar uninitialized resource and out-of-bounds issues.

How to fix it

Upgrade the Linux kernel to a version containing commit fd89d92c1140cee8f59de336cb37fa65e359c123 or later; for Rocky Linux 8 shim-unsigned-aarch64 update to 0:15-7.el8.1.1. Reboot after applying the fixed package.

How to confirm the fix worked

Confirm the running kernel contains the patch commit fd89d92c1140cee8f59de336cb37fa65e359c123; attempt to mount a short-journal OCFS2 image in a test environment and verify absence of the NULL dereference; inspect ocfs2_journal_shutdown for the added JBD2_LOADED flag check.

Typical attack path

1. Gain local user access on a system using OCFS2
2. Prepare or obtain a filesystem image with insufficient journal size
3. Trigger mount of the malformed volume
4. Cause journal load failure followed by shutdown path dereference
5. Induce kernel panic and denial of service

How to detect it

Search kernel logs and dmesg for oops/panic traces referencing ocfs2_journal_shutdown, jbd2_journal_flush, __jbd2_update_log_tail, or jbd2_journal_update_sb_log_tail combined with NULL pointer dereference; examine audit logs for unexpected mount attempts of OCFS2 volumes.

• ocfs2_journal_shutdown
• jbd2_journal_update_sb_log_tail
• lock_buffer(journal->j_sb_buffer)
• NULL pointer dereference in ocfs2
• JBD2_LOADED

What your security team should do

• Apply the kernel update containing fd89d92c1140cee8f59de336cb37fa65e359c123 immediately on all OCFS2-using systems
• Prioritize patching production clustered storage nodes before general workloads
• Monitor kernel logs for OCFS2 and JBD2 panic signatures until patches are deployed
• Restrict untrusted local access to systems hosting OCFS2 volumes