CVE-2024-58094

What it actually does

Missing read-only check in jfs_truncate_nolock allows truncation code path to reach txEnd with a NULL log pointer on read-only JFS volumes, resulting in failed write attempts or kernel errors during block_write_begin failure handling.

Why it matters to the business

Organizations running Red Hat Enterprise Linux 9 with tuned packages and JFS filesystems risk unexpected system instability or service interruptions during routine file operations on read-only volumes, increasing operational overhead in environments with many dependent systems.

How an attack unfolds

A local attacker triggers file truncation on a read-only JFS filesystem; the missing isReadOnly guard lets execution continue into xtTruncate with COMMIT_WMAP and onward to txEnd, where the NULL log dereference produces errors or crashes instead of cleanly aborting.

How to fix it

Upgrade all listed tuned packages on Red Hat Enterprise Linux 9 to version 2.24.0-2.el9_5 or later; apply kernel updates that include the JFS read-only check if separate kernel packages are in use; verify mounts remain read-only where intended.

How to confirm the fix worked

Confirm package versions match or exceed the fixed releases; test JFS read-only mounts by attempting truncation and verifying clean abort without log-related errors; review kernel source or changelog for the isReadOnly guard in jfs_truncate_nolock.

Typical attack path

1. Obtain local user access on affected system
2. Identify or create JFS filesystem mounted read-only
3. Perform write or truncate operation that invokes jfs_truncate_nolock
4. Trigger block_write_begin failure path leading to NULL log access

How to detect it

Review system logs for JFS-related errors around txEnd or NULL log references during file operations; correlate with process activity attempting truncation on read-only mounts; no widespread exploitation artifacts reported.

What your security team should do

• Prioritize patching tuned packages on all Red Hat Enterprise Linux 9 systems within standard change windows
• Audit JFS usage and enforce read-only mounts where writes are not required
• Monitor for related kernel JFS issues given the pattern of similar CVEs