CVE-2024-53234

What it actually does

The flaw causes erofs to mishandle NONHEAD lclusters where delta[1]==0 (from crafted images or pre-1.0 mkfs), resulting in incorrect decompressed length calculations during FIEMAP operations and triggering warnings in iomap_iter_done.

Why it matters to the business

Linux systems using erofs may experience incorrect file layout reporting for legacy or maliciously crafted filesystems, impacting tools that rely on accurate FIEMAP data such as backups or disk analysis, with low immediate operational disruption given the low EPSS and lack of KEV status.

How an attack unfolds

An attacker crafts an erofs image with NONHEAD lclusters having delta[1]==0 or illegal lclusterbits >14, mounts it on a vulnerable kernel, and issues fiemap ioctls to trigger the improper input validation path; threat actor mentions of espionage and financially motivated campaigns highlight potential use in Linux kernel targeting for out-of-bounds access scenarios.

How to fix it

Upgrade the Linux kernel to the fixed commit d5226fa6dbae0569ee43ecfc08bdcd6770fc4755 in the torvalds/linux.git repository; rebuild and deploy the updated kernel across all affected systems.

How to confirm the fix worked

Verify the running kernel contains commit d5226fa6dbae0569ee43ecfc08bdcd6770fc4755 or later; test fiemap operations on legacy erofs images to confirm absence of the iomap warning.

Typical attack path

1. Create or obtain a crafted erofs filesystem image exploiting NONHEAD lcluster edge cases
2. Mount the image on an unpatched Linux kernel
3. Invoke fiemap ioctl or related filesystem inspection operations
4. Trigger inadequate length handling leading to WARNING in iomap code

How to detect it

Search kernel logs and audit trails for iomap_iter_done WARNING messages triggered via fiemap on erofs; review mount and ioctl activity involving erofs images from untrusted sources, incorporating context from known Linux kernel out-of-bounds campaigns.

• WARNING in iomap_iter_done
• iomap_fiemap+0x73b/0x9b0
• ioctl_fiemap

What your security team should do

• Apply the kernel fix immediately on all erofs-using systems due to the published date and potential for crafted image attacks
• Monitor for erofs-related kernel warnings in system logs
• Audit use of erofs filesystems created with pre-1.0 mkfs tools