CVE-2024-53130

What it actually does

A NULL pointer dereference occurs in the block:block_dirty_buffer tracepoint when mark_buffer_dirty() is called on a buffer head whose b_bdev pointer is unset, which can happen in nilfs2 after buffers are detached and reattached without setting the block device.

Why it matters to the business

Systems using the nilfs2 filesystem may experience kernel crashes or faults when tracing is enabled, leading to service disruption and requiring reboots; the issue is local-only and has low observed exploitation activity.

How an attack unfolds

An attacker with local access enables the block_dirty_buffer tracepoint, triggers nilfs2 metadata buffer operations that leave b_bdev unset after try_to_free_buffers and create_empty_buffers, then calls mark_buffer_dirty to dereference the null pointer.

How to fix it

Update the Linux kernel to a version containing commit 7af3309c7a2ef26831a67125b11c34a7e01c1b2a or later; for affected git packages on Ubuntu 14.04 LTS apply version 1:1.9.1-1ubuntu0.3 or newer.

How to confirm the fix worked

Confirm the kernel source contains the fix in nilfs_grab_buffer that unconditionally sets bh->b_bdev from the superblock, then rebuild, boot the new kernel, and verify no NULL dereference occurs when the tracepoint is active during nilfs2 operations.

Typical attack path

1. Obtain local user access on a system using nilfs2
2. Enable the block:block_dirty_buffer tracepoint
3. Perform filesystem operations that cause buffer heads to be detached and reattached without a block device pointer
4. Invoke mark_buffer_dirty on the affected buffer to trigger the dereference

How to detect it

Review kernel logs for NULL pointer dereference or general protection faults in mark_buffer_dirty when the block_dirty_buffer tracepoint is active; correlate with nilfs2 metadata operations and absence of a block device pointer on buffer heads.

What your security team should do

• Prioritize kernel updates on any systems running nilfs2
• Disable the block_dirty_buffer tracepoint until patches are applied if tracing is not required
• Monitor for kernel oops or KASAN reports involving mark_buffer_dirty on nilfs2 volumes