CVE-2024-50218

What it actually does

The flaw stems from improper input validation in ocfs2_remove_inode_range where byte_start and byte_len can exceed ocfs2_max_inline_data_with_xattr and are passed as unsigned int to ocfs2_truncate_inline, enabling integer overflow and a subsequent kernel BUG.

Why it matters to the business

Systems relying on OCFS2 may experience kernel crashes or denial of service; the issue appears in older Samba packages on Ubuntu 14.04/16.04 with low exploitation probability and no ransomware association, though listed in broad 2024 kernel exploitation campaigns.

How an attack unfolds

An attacker supplies oversized parameters to ocfs2_remove_inode_range, bypassing the missing sanity check before calling ocfs2_truncate_inline; this has been referenced in 2024 zero-day campaigns by espionage and financially motivated actors targeting Linux kernel out-of-bounds issues.

How to fix it

Upgrade affected Samba packages to the listed fixed versions: 2:4.1.6+dfsg-1ubuntu2.14.04.13 on Ubuntu 14.04 LTS and 2:4.3.6+dfsg-1ubuntu1 on Ubuntu 16.04 LTS; apply kernel updates that include the sanity check for byte_start and byte_len.

How to confirm the fix worked

Verify package versions match the fixed releases above and confirm presence of the added sanity check in ocfs2_remove_inode_range; test with Syzbot-style inputs to ensure no BUG is triggered.

Typical attack path

1. Identify a system running vulnerable OCFS2/Samba kernel code
2. Trigger ocfs2_remove_inode_range via crafted file system or Samba operations with large byte values
3. Cause overflow in truncate_inline leading to kernel BUG or crash
4. Escalate to denial of service or attempt further kernel exploitation

How to detect it

Search kernel logs and dmesg for messages referencing ocfs2_truncate_inline or BUG triggered from ocfs2_remove_inode_range; correlate with Samba access patterns on affected Ubuntu releases.

• ocfs2_truncate_inline
• BUG: ocfs2_remove_inode_range
• byte_start > ocfs2_max_inline_data_with_xattr

What your security team should do

• Apply the exact fixed package versions immediately on all Ubuntu 14.04/16.04 systems
• Monitor kernel logs for ocfs2_truncate_inline BUG reports
• Review and restrict OCFS2 filesystem usage where possible until patched