CVE-2024-56596

What it actually does

Array-index-out-of-bounds read in jfs_readdir when stbl contains invalid values, allowing out-of-bounds kernel memory access during directory enumeration on JFS filesystems.

Why it matters to the business

Systems running older Ubuntu kernels with JFS may experience crashes, data corruption, or potential privilege escalation when mounting or accessing specially crafted filesystems; high prevalence in legacy LTS deployments increases exposure for organizations still using 14.04/16.04 series packages.

How an attack unfolds

An attacker creates a malicious JFS image containing an stbl array with out-of-range indices, then causes a victim system to mount the image or run readdir on it; without the validation check the kernel performs an invalid array access that can be leveraged for further memory corruption or information disclosure by espionage or financially motivated actors.

How to fix it

Upgrade affected packages to the listed fixed versions: linux 3.13.0-91.138 or 4.4.0-28.47, linux-aws 4.4.0-1002.2 or 4.4.0-1001.10, linux-azure 4.15.0-1023.24~14.04.1 or 4.11.0-1009.9, and equivalent updates for linux-lts-xenial, linux-hwe, linux-gcp, linux-kvm, linux-oem, linux-raspi2, linux-snapdragon and related metapackages; apply the kernel updates and reboot.

How to confirm the fix worked

Confirm kernel package versions match or exceed the fixed releases above via dpkg -l | grep linux-image, then verify JFS readdir no longer accepts invalid stbl by mounting test images or running filesystem consistency tools.

Typical attack path

1. Craft malicious JFS filesystem image with invalid stbl values
2. Deliver image to target via removable media, network share, or compromised package
3. Trigger mount or directory enumeration on the image
4. Exploit resulting out-of-bounds access for kernel memory read/write or denial of service

How to detect it

Review kernel logs for JFS-related oops or array bounds warnings, correlate with unexpected mounts of JFS volumes, and search auditd or syslog for readdir calls on untrusted media; threat actor campaigns targeting Linux kernel out-of-bounds issues provide context for prioritizing these artifacts.

What your security team should do

• Prioritize patching all 14.04 and 16.04 LTS systems still using JFS before end-of-life exposure widens
• Audit for JFS usage with find / -type f -name "*.jfs" or mount | grep jfs and migrate workloads to ext4/xfs where possible
• Enable kernel module signing and restrict untrusted filesystem mounts via mount options or AppArmor
• Monitor EPSS trend and threat actor reports for any rise in Linux kernel filesystem exploitation