CVE-2024-56619

What it actually does

Integer truncation in nilfs_last_byte() when computing directory entry byte counts from a corrupted 64-bit i_size causes underflow, leading to out-of-bounds memory reads or use-after-free in nilfs_find_entry() within the nilfs2 filesystem.

Why it matters to the business

Systems using the nilfs2 filesystem may experience crashes, memory corruption, or potential privilege escalation when processing malicious or corrupted directory metadata, increasing operational risk and downtime for affected Linux deployments.

How an attack unfolds

An attacker supplies a directory inode with an artificially large or corrupted i_size value; when the kernel performs directory lookups via nilfs_find_entry(), the truncated size calculation produces an offset exceeding page boundaries, triggering out-of-bounds access or KASAN-detected use-after-free.

How to fix it

Upgrade the Linux kernel to a version containing commit 09d6d05579fd46e61abf6e457bb100ff11f3a9d3 or later; rebuild and reboot with the patched kernel. Disable nilfs2 if the filesystem is not required.

How to confirm the fix worked

Verify the running kernel contains the fix by checking the nilfs_last_byte() implementation uses a u64 variable for size calculations; test with crafted directory inodes that previously triggered KASAN reports.

Typical attack path

1. Mount a nilfs2 filesystem containing a directory with corrupted i_size metadata
2. Trigger directory enumeration or file lookup operations that invoke nilfs_find_entry()
3. Cause the kernel to compute an invalid byte offset due to 32-bit truncation
4. Access memory outside the allocated folio or page, resulting in crash or memory corruption

How to detect it

Review kernel logs for nilfs2-related oops, page faults, or KASAN out-of-bounds warnings during directory operations; inspect filesystem images for directories reporting unexpectedly large i_size values.

What your security team should do

• Apply the kernel patch immediately on all systems using nilfs2
• Audit for nilfs2 usage across the environment and prioritize high-exposure hosts
• Monitor for unusual kernel oops or KASAN reports involving nilfs2 directory operations