In the Linux kernel, the following vulnerability has been resolved:
ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()
Syzkaller is able to provoke null-ptr-dereference in ocfs2_xa_remove():
[ 57.319872] (a.out,1161,7):ocfs2_xa_remove:2028 ERROR: status = -12 [ 57.320420] (a.out,1161,7):ocfs2_xa_cleanup_value_truncate:1999 ERROR: Partial truncate while removing xattr overlay.upper. Leaking 1 clusters and removing the entry [ 57.321727] BUG: kernel NULL pointer dereference, address: 0000000000000004 [...] [ 57.325727] RIP: 0010:ocfs2_xa_block_wipe_namevalue+0x2a/0xc0 [...] [ 57.331328] Call Trace: [ 57.331477] <TASK> [...] [ 57.333511] ? do_user_addr_fault+0x3e5/0x740 [ 57.333778] ? exc_page_fault+0x70/0x170 [ 57.334016] ? asm_exc_page_fault+0x2b/0x30 [ 57.334263] ? __pfx_ocfs2_xa_block_wipe_namevalue+0x10/0x10 [ 57.334596] ? ocfs2_xa_block_wipe_namevalue+0x2a/0xc0 [ 57.334913] ocfs2_xa_remove_entry+0x23/0xc0 [ 57.335164] ocfs2_xa_set+0x704/0xcf0 [ 57.335381] ? _raw_spin_unlock+0x1a/0x40 [ 57.335620] ? ocfs2_inode_cache_unlock+0x16/0x20 [ 57.335915] ? trace_preempt_on+0x1e/0x70 [ 57.336153] ? start_this_handle+0x16c/0x500 [ 57.336410] ? preempt_count_sub+0x50/0x80 [ 57.336656] ? _raw_read_unlock+0x20/0x40 [ 57.336906] ? start_this_handle+0x16c/0x500 [ 57.337162] ocfs2_xattr_block_set+0xa6/0x1e0 [ 57.337424] __ocfs2_xattr_set_handle+0x1fd/0x5d0 [ 57.337706] ? ocfs2_start_trans+0x13d/0x290 [ 57.337971] ocfs2_xattr_set+0xb13/0xfb0 [ 57.338207] ? dput+0x46/0x1c0 [ 57.338393] ocfs2_xattr_trusted_set+0x28/0x30 [ 57.338665] ? ocfs2_xattr_trusted_set+0x28/0x30 [ 57.338948] __vfs_removexattr+0x92/0xc0 [ 57.339182] __vfs_removexattr_locked+0xd5/0x190 [ 57.339456] ? preempt_count_sub+0x50/0x80 [ 57.339705] vfs_removexattr+0x5f/0x100 [...]
Reproducer uses faultinject facility to fail ocfs2_xa_remove() -> ocfs2_xa_value_truncate() with -ENOMEM.
In this case the comment mentions that we can return 0 if ocfs2_xa_cleanup_value_truncate() is going to wipe the entry anyway. But the following 'rc' check is wrong and execution flow do 'ocfs2_xa_remove_entry(loc);' twice: * 1st: in ocfs2_xa_cleanup_value_truncate(); * 2nd: returning back to ocfs2_xa_remove() instead of going to 'out'.
Fix this by skipping the 2nd removal of the same entry and making syzkaller repro happy.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux-6.1Upgrade linux | Dec 2, 2024 | Nov 19, 2024 |
| Oracle_linux | — | Upgrade kernel-uek | Feb 10, 2025 | Nov 19, 2024 |
| Ubuntu | — | Upgrade linux-image-6.11.0-1010-lowlatency-64kUpgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-58-genericUpgrade linux-image-6.8.0-1026-nvidia-lowlatency-64kUpgrade linux-image-5.15.0-133-generic-lpaeUpgrade linux-image-6.8.0-1026-nvidia-lowlatencyUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-5.15.0-133-generic-64kUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-realtime-hwe-24.04Upgrade linux-image-oracle-lts-20.04Upgrade linux-image-oracle-lts-22.04Upgrade linux-image-5.15.0-1060-gkeopUpgrade linux-image-6.8.0-1023-gkeUpgrade linux-image-azureUpgrade linux-image-6.8.0-1027-azureUpgrade linux-image-4.15.0-1134-fipsUpgrade linux-image-6.8.0-1024-oracleUpgrade linux-image-4.15.0-2096-azure-fipsUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-5.15.0-1078-awsUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-4.4.0-267-lowlatencyUpgrade linux-image-6.11.0-1009-awsUpgrade linux-image-5.4.0-1116-fipsUpgrade linux-image-kvmUpgrade linux-image-6.11.0-18-genericUpgrade linux-image-6.11.0-1008-raspiUpgrade linux-image-6.8.0-1024-ibmUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-5.15.0-1072-nvidia-lowlatencyUpgrade linux-image-5.15.0-134-generic-lpaeUpgrade linux-image-5.15.0-1077-gcpUpgrade linux-image-6.11.0-1015-oemUpgrade linux-image-5.4.0-1142-awsUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1026-oemUpgrade linux-image-gcp-fipsUpgrade linux-image-6.8.0-1026-nvidia-64kUpgrade linux-image-4.15.0-1162-kvmUpgrade linux-image-gcp-64kUpgrade linux-image-6.11.0-18-generic-64kUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-5.4.0-1127-kvmUpgrade linux-image-5.4.0-1099-bluefieldUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-5.15.0-133-lowlatencyUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-6.11.0-1010-lowlatencyUpgrade linux-image-5.4.0-1138-oracleUpgrade linux-image-aws-fipsUpgrade linux-image-azure-lts-18.04Upgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-4.4.0-1180-awsUpgrade linux-image-5.4.0-1145-azureUpgrade linux-image-intel-iotgUpgrade linux-image-5.15.0-1044-xilinx-zynqmpUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-5.15.0-1073-intel-iotgUpgrade linux-image-5.4.0-208-genericUpgrade linux-image-aws-hweUpgrade linux-image-6.8.0-1028-gcp-64kUpgrade linux-image-oem-22.04cUpgrade linux-image-5.15.0-1075-oracleUpgrade linux-image-5.15.0-1072-nvidiaUpgrade linux-image-gkeop-5.15Upgrade linux-image-nvidia-tegra-igxUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-oracle-lts-18.04Upgrade linux-image-4.15.0-2117-aws-fipsUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-6.8.0-1010-gkeopUpgrade linux-image-6.8.0-1027-azure-fdeUpgrade linux-image-realtimeUpgrade linux-image-6.8.0-1026-nvidiaUpgrade linux-image-oemUpgrade linux-image-raspiUpgrade linux-image-oem-22.04dUpgrade linux-image-nvidia-64kUpgrade linux-image-nvidia-6.8Upgrade linux-image-aws-lts-18.04Upgrade linux-image-azure-cvmUpgrade linux-image-oracleUpgrade linux-image-oem-24.04Upgrade linux-image-4.4.0-1112-fipsUpgrade linux-image-5.4.0-1048-iotUpgrade linux-image-oem-20.04Upgrade linux-image-aws-lts-24.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-oem-20.04cUpgrade linux-image-awsUpgrade linux-image-4.15.0-1187-azureUpgrade linux-image-5.15.0-1070-ibmUpgrade linux-image-gkeUpgrade linux-image-5.4.0-1140-awsUpgrade linux-image-5.15.0-134-generic-64kUpgrade linux-image-6.8.0-58-lowlatency-64kUpgrade linux-image-aws-lts-20.04Upgrade linux-image-5.15.0-1080-awsUpgrade linux-image-5.15.0-1076-kvmUpgrade linux-image-6.11.0-1009-gcpUpgrade linux-image-lowlatencyUpgrade linux-image-ibm-classicUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-azure-lts-24.04Upgrade linux-image-generic-hwe-18.04Upgrade linux-image-gke-5.15Upgrade linux-image-6.11.0-1011-oracleUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-aws-lts-22.04Upgrade linux-image-5.15.0-1033-nvidia-tegraUpgrade linux-image-generic-64kUpgrade linux-image-6.8.0-58-generic-64kUpgrade linux-image-5.4.0-1058-xilinx-zynqmpUpgrade linux-image-6.8.0-1027-awsUpgrade linux-image-azure-lts-20.04Upgrade linux-image-5.15.0-1081-azureUpgrade linux-image-5.4.0-208-generic-lpaeUpgrade linux-image-oem-22.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-nvidia-tegraUpgrade linux-image-azure-lts-22.04Upgrade linux-image-4.4.0-1142-awsUpgrade linux-image-4.15.0-2080-gcp-fipsUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-5.4.0-1129-raspiUpgrade linux-image-lowlatency-64kUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-5.4.0-1143-gcpUpgrade linux-image-6.8.0-1028-raspiUpgrade linux-image-5.15.0-1021-nvidia-tegra-igxUpgrade linux-image-5.15.0-1021-nvidia-tegra-igx-rtUpgrade linux-image-4.4.0-1143-kvmUpgrade linux-image-6.8.0-1028-gcpUpgrade linux-image-raspi-nolpaeUpgrade linux-image-raspi2Upgrade linux-image-6.11.0-1009-azureUpgrade linux-image-5.15.0-134-genericUpgrade linux-image-azure-fdeUpgrade linux-image-5.15.0-133-lowlatency-64kUpgrade linux-image-generic-lpaeUpgrade linux-image-5.15.0-1075-gkeUpgrade linux-image-4.15.0-236-genericUpgrade linux-image-4.15.0-1179-awsUpgrade linux-image-5.4.0-1086-ibmUpgrade linux-image-fipsUpgrade linux-image-nvidia-tegra-rtUpgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-6.8.0-58-lowlatencyUpgrade linux-image-4.15.0-236-lowlatencyUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-6.11.0-1009-azure-fdeUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-ibmUpgrade linux-image-generic-lts-xenialUpgrade linux-image-azure-nvidiaUpgrade linux-image-oem-20.04dUpgrade linux-image-azure-fipsUpgrade linux-image-virtual-hwe-16.04Upgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-4.15.0-1172-gcpUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-virtualUpgrade linux-image-nvidiaUpgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-5.15.0-1072-raspiUpgrade linux-image-oem-24.04aUpgrade linux-image-6.8.1-1020-realtimeUpgrade linux-image-oem-20.04bUpgrade linux-image-intelUpgrade linux-image-raspi-realtimeUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-ibm-lts-20.04Upgrade linux-image-oem-24.04bUpgrade linux-image-5.15.0-1081-azure-fdeUpgrade linux-image-gkeopUpgrade linux-image-gkeop-6.8Upgrade linux-image-5.15.0-1074-ibmUpgrade linux-image-gcp-lts-18.04Upgrade linux-image-5.4.0-208-lowlatencyUpgrade linux-image-oem-osp1Upgrade linux-image-6.8.0-2023-raspi-realtimeUpgrade linux-image-6.11.0-1005-realtimeUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-6.8.0-1014-azure-nvidiaUpgrade linux-image-gcpUpgrade linux-image-5.15.0-1033-nvidia-tegra-rtUpgrade linux-image-genericUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.11.0-1011-oracle-64kUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-oem-22.04aUpgrade linux-image-4.4.0-267-genericUpgrade linux-image-5.15.0-133-genericUpgrade linux-image-generic-hwe-16.04Upgrade linux-image-oem-22.04bUpgrade linux-image-4.15.0-1141-oracleUpgrade linux-image-6.8.0-1024-oracle-64kUpgrade linux-image-bluefield | Feb 20, 2025 | Nov 19, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 13, 2025 | Nov 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub