CVE-2024-56570

What it actually does

The flaw permits processing of directory inodes lacking a lookup function in ovl_dentry_weird(), allowing invalid inodes to reach overlayfs lowerstack and trigger errors.

Why it matters to the business

Overlayfs-dependent Linux systems risk instability or errors during filesystem operations; low EPSS and no KEV status indicate limited immediate risk despite publication over a year ago and mentions in broad espionage/financial campaigns, but high ecosystem prevalence of the kernel warrants prompt updates to avoid operational disruptions.

How an attack unfolds

An attacker supplies crafted directory inodes without lookup functions to overlayfs (e.g., via malicious lower filesystems or mounts), bypassing prior checks and causing errors; contexts like 2024 zero-day campaigns or Linux kernel out-of-bounds issues may overlap but no confirmed exploitation path for this specific flaw exists.

How to fix it

Apply kernel updates containing commit f9248e2f73fb4afe08324485e98c815ac084d166; for listed libarchive packages on Ubuntu 14.04 LTS update to 3.1.2-7ubuntu2.3 and on 16.04 LTS to 3.1.2-11ubuntu0.16.04.2.

How to confirm the fix worked

Confirm presence of the filtering check in ovl_dentry_weird() after applying the referenced commit; test overlayfs mounts with invalid inodes to verify errors are now rejected.

Typical attack path

1. Identify systems using overlayfs mounts
2. Prepare malicious lower filesystem containing invalid directory inodes
3. Trigger overlayfs mount or dentry operations that invoke ovl_dentry_weird()
4. Observe or exploit resulting errors in lowerstack processing

How to detect it

Inspect kernel logs for overlayfs dentry or inode processing errors; correlate with mount operations involving lower filesystems and check for references to missing lookup functions or weird dentries.

What your security team should do

• Prioritize kernel package upgrades across all affected distributions
• Audit overlayfs usage in container and filesystem workloads
• Monitor changelogs for backports of f9248e2f73fb4afe08324485e98c815ac084d166
• Review systems for any custom overlay mounts that may surface the issue