CVE-2024-50116

What it actually does

Failure to clear the buffer delay flag during nilfs2 page/folio or buffer head state reset in its custom clear routine allows a BUG_ON assertion in submit_bh_wbc() to trigger after a corrupted filesystem image forces read-only degradation.

Why it matters to the business

Systems relying on the nilfs2 filesystem may experience unexpected kernel crashes or panics when encountering corrupted images, leading to service disruption, data access loss, and unplanned reboots with potential impact on availability for any downstream workloads or appliances using affected kernels.

How an attack unfolds

An attacker supplies or induces a corrupted nilfs2 filesystem image; the kernel reads the image, degrades the mount to read-only, and later operations that invoke the page-clear path without clearing the delay flag hit the assertion during block submission, causing a kernel bug.

How to fix it

Update to a Linux kernel containing the nilfs2 buffer flag clearing fix. For the listed flashplugin-nonfree packages on Ubuntu 14.04 LTS, apply the update to version 11.2.202.521ubuntu0.14.04.1. Reboot after kernel updates and verify nilfs2 mounts succeed without triggering the assertion on known-corrupt images.

How to confirm the fix worked

Confirm the kernel source contains the nilfs2 state-flag clearing change before buffer discard; test by mounting a deliberately corrupted nilfs2 image, forcing read-only mode, and exercising page-clear paths while monitoring for BUG_ON in submit_bh_wbc().

Typical attack path

1. Craft or obtain a maliciously corrupted nilfs2 filesystem image
2. Cause the target system to mount the image (local or via untrusted media)
3. Trigger nilfs2 read-only degradation due to detected corruption
4. Perform operations that invoke the expanded nilfs2 page-clear routine
5. Reach submit_bh_wbc() with the stale buffer delay flag set, hitting BUG_ON

How to detect it

Search kernel logs for BUG_ON messages or stack traces involving submit_bh_wbc and buffer delay flags after nilfs2 read-only degradation events; inspect dmesg or syslog for nilfs2 corruption warnings followed by kernel panics.

What your security team should do

• Prioritize kernel updates on any systems using nilfs2, especially those exposed to untrusted filesystem images
• Audit nilfs2 usage across the environment and restrict mounting of external or user-supplied images until patched
• Monitor for kernel oops or BUG reports referencing submit_bh_wbc or buffer delay flags
• Apply the referenced flashplugin-nonfree package update where present even if unrelated to kernel path