CVE-2024-56595

What it actually does

Missing bounds check in JFS dbAdjTree allows lp value of 0 to underflow to negative index during for-loop iteration, enabling array out-of-bounds access.

Why it matters to the business

Potential kernel instability, crashes, or code execution affecting Linux systems using JFS; low exploit probability but impacts organizations running older kernels with JFS workloads.

How an attack unfolds

An attacker with local access crafts or manipulates a JFS filesystem image or operations to force lp=0 at dbAdjTree entry, triggering negative index and out-of-bounds memory access; observed in broad Linux kernel exploitation campaigns by espionage and financially motivated actors.

How to fix it

Apply kernel patch b15000bcbecf27e0f7c0f149a409e5b865e28ca2 or upgrade to fixed versions; for listed Ubuntu packages update webkit2gtk to 2.12.5-0ubuntu0.16.04.1 or later.

How to confirm the fix worked

Verify kernel source contains the added lp==0 bail-out check or confirm running kernel built after the referenced commit; test JFS operations that previously triggered the loop condition.

Typical attack path

1. Obtain local access or ability to mount/operate on JFS volume
2. Trigger dbAdjTree with lp initialized to 0
3. Cause underflow in loop index assignment
4. Perform out-of-bounds read or write

How to detect it

Review kernel logs for JFS-related oops or panic messages involving dbAdjTree; correlate with file system mount events and process activity on systems with JFS usage; watch for indicators from listed Linux kernel out-of-bounds campaigns.

What your security team should do

• Prioritize kernel updates on all systems using JFS
• Monitor EPSS trend and re-evaluate if exploit maturity increases
• Restrict untrusted JFS mounts until patched