CVE-2024-56598

What it actually does

Out-of-bounds array access in the dtReadFirst function of the JFS filesystem driver caused by malformed on-disk structures that allow stbl to exceed valid bounds, resulting in memory corruption.

Why it matters to the business

Systems using the JFS filesystem on Linux kernels may experience crashes, data corruption, or unexpected reboots when encountering damaged filesystems, increasing operational downtime and recovery costs; the issue is widespread across kernel distributions but carries low exploitation probability.

How an attack unfolds

An attacker supplies a specially crafted malicious JFS filesystem image containing out-of-bounds stbl values; when the image is mounted or the filesystem is accessed, the kernel code in dtReadFirst performs an unchecked array access that can lead to memory corruption or a denial of service.

How to fix it

Update the Linux kernel to a version containing commit 25f1e673ef61d6bf9a6022e27936785896d74948 which adds the bounds check and appropriate error return in dtReadFirst; rebuild and reboot into the patched kernel.

How to confirm the fix worked

Verify the running kernel contains commit 25f1e673ef61d6bf9a6022e27936785896d74948, attempt to mount a test filesystem containing invalid stbl values, and confirm the operation returns an error instead of triggering an out-of-bounds access or panic.

Typical attack path

1. Craft or obtain a JFS filesystem image with invalid stbl values
2. Place the image on a storage device accessible to the target system
3. Mount the filesystem or trigger metadata reads that invoke dtReadFirst
4. Trigger the out-of-bounds access to induce kernel panic or memory corruption

How to detect it

Review kernel logs for oops or panic messages referencing dtReadFirst or JFS array bounds violations; examine mount attempts of suspicious JFS volumes and correlate with filesystem check failures.

What your security team should do

• Apply the kernel update containing commit 25f1e673ef61d6bf9a6022e27936785896d74948 as soon as packages are available from your distribution
• Audit systems for JFS filesystem usage and schedule filesystem checks on potentially damaged volumes
• Monitor kernel logs for JFS-related oops or panic entries until patches are deployed