{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-42105", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-29T15:50:41.175Z", "datePublished": "2024-07-30T07:46:01.061Z", "dateUpdated": "2026-08-05T11:35:38.984Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:35:38.984Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix inode number range checks\n\nPatch series \"nilfs2: fix potential issues related to reserved inodes\".\n\nThis series fixes one use-after-free issue reported by syzbot, caused by\nnilfs2's internal inode being exposed in the namespace on a corrupted\nfilesystem, and a couple of flaws that cause problems if the starting\nnumber of non-reserved inodes written in the on-disk super block is\nintentionally (or corruptly) changed from its default value. \n\n\nThis patch (of 3):\n\nIn the current implementation of nilfs2, \"nilfs->ns_first_ino\", which\ngives the first non-reserved inode number, is read from the superblock,\nbut its lower limit is not checked.\n\nAs a result, if a number that overlaps with the inode number range of\nreserved inodes such as the root directory or metadata files is set in the\nsuper block parameter, the inode number test macros (NILFS_MDT_INODE and\nNILFS_VALID_INODE) will not function properly.\n\nIn addition, these test macros use left bit-shift calculations using with\nthe inode number as the shift count via the BIT macro, but the result of a\nshift calculation that exceeds the bit width of an integer is undefined in\nthe C specification, so if \"ns_first_ino\" is set to a large value other\nthan the default value NILFS_USER_INO (=11), the macros may potentially\nmalfunction depending on the environment.\n\nFix these issues by checking the lower bound of \"nilfs->ns_first_ino\" and\nby preventing bit shifts equal to or greater than the NILFS_USER_INO\nconstant in the inode number test macros.\n\nAlso, change the type of \"ns_first_ino\" from signed integer to unsigned\ninteger to avoid the need for type casting in comparisons such as the\nlower bound check introduced this time." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The malicious `s_first_ino` value is consumed only by `nilfs_store_disk_layout()` at mount time, so the attacker must present a crafted nilfs2 block device/image to the local system (removable media, loop file, or container image). There is no network-facing path into this code.\nAC:L - The attacker fully controls the superblock field and the on-disk directory entries and raw inodes, so the reserved-inode confusion and the out-of-range `BIT(ino)` shift are triggered deterministically on the first lookup — no race, no memory-layout dependency.\nPR:L - An unprivileged local user can get an attacker-supplied nilfs2 image mounted through desktop automount daemons (udisks2/systemd), user-mountable fstab entries, or a CAP_SYS_ADMIN-holding container, and then drives the vulnerable lookup path with ordinary file operations. No real root in the initial namespace is needed for the realistic scenario.\nUI:N - On systems with removable-media automounting the image is mounted and its directories scanned without any deliberate victim action, and once mounted the attacker reaches the bug entirely through their own syscalls.\nS:U - The corruption and the resulting use-after-free are confined to kernel memory and the nilfs2 filesystem under the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Internal metadata inodes (ifile, DAT, cpfile, sufile) become addressable as ordinary namespace files, exposing raw filesystem metadata, and the resulting use-after-free of those metadata inodes gives an attacker-influenceable read of reclaimed kernel slab memory.\nI:H - `nilfs_evict_inode()` calls `nilfs_ifile_delete_inode()` on the metadata inodes themselves, destroying filesystem metadata, and the metadata-inode use-after-free is a classic heap-spray target that can be leveraged into a kernel write primitive.\nA:H - The syzbot-reported manifestation is a use-after-free of metadata file inodes that trips a kernel BUG in `lru_add_fn()`; the misclassification also drives the filesystem into a `nilfs_error()` state, so the attacker reliably achieves a kernel crash." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/nilfs2/nilfs.h", "fs/nilfs2/the_nilfs.c", "fs/nilfs2/the_nilfs.h" ], "versions": [ { "version": "8a9d2191e9f43bbcd256a9a6871bd73434c83f2f", "lessThan": "57235c3c88bb430043728d0d02f44a4efe386476", "status": "affected", "versionType": "git" }, { "version": "8a9d2191e9f43bbcd256a9a6871bd73434c83f2f", "lessThan": "08cab183a624ba71603f3754643ae11cab34dbc4", "status": "affected", "versionType": "git" }, { "version": "8a9d2191e9f43bbcd256a9a6871bd73434c83f2f", "lessThan": "731011ac6c37cbe97ece229fc6daa486276052c5", "status": "affected", "versionType": "git" }, { "version": "8a9d2191e9f43bbcd256a9a6871bd73434c83f2f", "lessThan": "3be4dcc8d7bea52ea41f87aa4bbf959efe7a5987", "status": "affected", "versionType": "git" }, { "version": "8a9d2191e9f43bbcd256a9a6871bd73434c83f2f", "lessThan": "fae1959d6ab2c52677b113935e36ab4e25df37ea", "status": "affected", "versionType": "git" }, { "version": "8a9d2191e9f43bbcd256a9a6871bd73434c83f2f", "lessThan": "9194f8ca57527958bee207919458e372d638d783", "status": "affected", "versionType": "git" }, { "version": "8a9d2191e9f43bbcd256a9a6871bd73434c83f2f", "lessThan": "1c91058425a01131ea30dda6cf43c67b17884d6a", "status": "affected", "versionType": "git" }, { "version": "8a9d2191e9f43bbcd256a9a6871bd73434c83f2f", "lessThan": "e2fec219a36e0993642844be0f345513507031f4", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/nilfs2/nilfs.h", "fs/nilfs2/the_nilfs.c", "fs/nilfs2/the_nilfs.h" ], "versions": [ { "version": "2.6.30", "status": "affected" }, { "version": "0", "lessThan": "2.6.30", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.318", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.280", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.222", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.163", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.98", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.39", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.9.9", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "4.19.318" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "5.4.280" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "5.10.222" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "5.15.163" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "6.1.98" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "6.6.39" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "6.9.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "6.10" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/57235c3c88bb430043728d0d02f44a4efe386476" }, { "url": "https://git.kernel.org/stable/c/08cab183a624ba71603f3754643ae11cab34dbc4" }, { "url": "https://git.kernel.org/stable/c/731011ac6c37cbe97ece229fc6daa486276052c5" }, { "url": "https://git.kernel.org/stable/c/3be4dcc8d7bea52ea41f87aa4bbf959efe7a5987" }, { "url": "https://git.kernel.org/stable/c/fae1959d6ab2c52677b113935e36ab4e25df37ea" }, { "url": "https://git.kernel.org/stable/c/9194f8ca57527958bee207919458e372d638d783" }, { "url": "https://git.kernel.org/stable/c/1c91058425a01131ea30dda6cf43c67b17884d6a" }, { "url": "https://git.kernel.org/stable/c/e2fec219a36e0993642844be0f345513507031f4" } ], "title": "nilfs2: fix inode number range checks", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/57235c3c88bb430043728d0d02f44a4efe386476", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/08cab183a624ba71603f3754643ae11cab34dbc4", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/731011ac6c37cbe97ece229fc6daa486276052c5", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/3be4dcc8d7bea52ea41f87aa4bbf959efe7a5987", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/fae1959d6ab2c52677b113935e36ab4e25df37ea", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/9194f8ca57527958bee207919458e372d638d783", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/1c91058425a01131ea30dda6cf43c67b17884d6a", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/e2fec219a36e0993642844be0f345513507031f4", "tags": [ "x_transferred" ] }, { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:01:41.084Z" } }, { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-42105", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T16:17:49.299547Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:32:45.818Z" } } ] } }