CVE-2024-53235

What it actually does

Null pointer dereference in fuse_read_args_fill triggered during erofs superblock read when a file-backed mount is performed over FUSE, causing a kernel crash.

Why it matters to the business

Attackers can crash systems that use erofs mounts backed by FUSE filesystems, leading to denial of service and potential loss of availability for affected Linux workloads.

How an attack unfolds

An attacker prepares a FUSE-based file that will be used as the backing store for an erofs mount, then triggers erofs_fc_fill_super which calls into the read path that assumes a valid file pointer, resulting in the null dereference.

How to fix it

Update the Linux kernel to version 6.12.2 or later, or apply the commit 5036f2f024cac40a02ea6ea70de2c3a4407d16bc. For affected Ubuntu releases, install the packages that contain libarchive 3.1.2-7ubuntu2.3 (14.04) or 3.1.2-11ubuntu0.16.04.2 (16.04).

How to confirm the fix worked

Verify the running kernel version is at least 6.12.2 and confirm the patch for erofs file-backed FUSE mounts is present; attempt to reproduce the original syzbot reproducer to ensure the null dereference no longer occurs.

Typical attack path

1. Create or obtain a FUSE filesystem implementation that supplies a file descriptor for use as erofs backing storage
2. Mount an erofs filesystem using that FUSE-backed file
3. Trigger erofs superblock reading code path that invokes filemap_read_folio on the FUSE file
4. Cause fuse_read_args_fill to receive a null pointer and dereference it

How to detect it

Review kernel logs for oops or panic messages referencing fuse_read_args_fill, erofs_bread, or filemap_read_folio; examine audit logs for unusual FUSE or erofs mount attempts by non-root users.

What your security team should do

• Prioritize kernel updates on any systems that permit user-controlled FUSE mounts or erofs usage
• Restrict unprivileged FUSE mounts via sysctl or mount namespaces until patches are applied
• Monitor for kernel oops reports containing erofs_bread or fuse_read_folio symbols