CVE-2024-50202

What it actually does

nilfs_find_entry() in the nilfs2 filesystem silently ignores read errors from nilfs_get_folio() when loading directory pages, allowing subsequent sanity checks in nilfs_check_folio() to fail repeatedly on corrupted images with large directory inodes and causing task hangs.

Why it matters to the business

Systems using nilfs2 on potentially corrupted storage can experience unrecoverable process hangs during directory operations, leading to service outages, delayed incident response, and forced reboots without data recovery guarantees.

How an attack unfolds

An attacker supplies or induces a corrupted nilfs2 filesystem image with an oversized directory inode; when the kernel attempts to open or traverse the directory, nilfs_find_entry() fails to propagate the folio load error, triggering repeated error logging and a hang in callers such as vcs_open().

How to fix it

Upgrade the Linux kernel to a version containing commit bb857ae1efd3138c653239ed1e7aef14e1242c81 or later; for affected Ubuntu packages update sosreport to 3.1-1ubuntu2.2 or newer; rebuild and redeploy any custom kernels or distributions that incorporate the vulnerable nilfs2 code.

How to confirm the fix worked

Confirm the kernel source contains the error-propagation change in nilfs_find_entry(); attempt to mount and access a crafted corrupted nilfs2 image in a test environment and verify that directory operations now return proper error codes instead of hanging.

Typical attack path

1. Mount a malicious or corrupted nilfs2 filesystem image
2. Trigger directory lookup via open, readdir, or dependent kernel paths
3. nilfs_get_folio() returns an error that nilfs_find_entry() discards
4. nilfs_check_folio() repeatedly fails sanity checks and logs errors
5. Calling task enters uninterruptible hang state

How to detect it

Search kernel logs for repeated nilfs_check_folio error bursts followed by task hang traces; monitor for processes stuck in D-state during directory operations on nilfs2 mounts; review auditd or syscall logs for unexpected EIO/ENOMEM returns from filesystem calls.

What your security team should do

• Prioritize kernel updates on all systems using nilfs2 filesystems
• Audit production workloads for nilfs2 usage and schedule controlled upgrades before the next maintenance window
• Add filesystem integrity checks and monitoring for nilfs2 mount failures
• Review backup and recovery procedures to handle corrupted nilfs2 images