CVE-2024-42311: Vulnerability in Linux Linux

Severity: mediumType: vulnerabilityCVE-2024-42311

In the Linux kernel, the following vulnerability has been resolved: hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode() Syzbot reports uninitialized value access issue as below: loop0: detected capacity change from 0 to 64 ===================================================== BUG: KMSAN: uninit-value in hfs_revalidate_dentry+0x307/0x3f0 fs/hfs/sysdep.c:30 hfs_revalidate_dentry+0x307/0x3f0 fs/hfs/sysdep.c:30 d_revalidate fs/namei.c:862 [inline] lookup_fast+0x89e/0x8e0 fs/namei.c:1649 walk_component fs/namei.c:2001 [inline] link_path_walk+0x817/0x1480 fs/namei.c:2332 path_lookupat+0xd9/0x6f0 fs/namei.c:2485 filename_lookup+0x22e/0x740 fs/namei.c:2515 user_path_at_empty+0x8b/0x390 fs/namei.c:2924 user_path_at include/linux/namei.h:57 [inline] do_mount fs/namespace.c:3689 [inline] __do_sys_mount fs/namespace.c:3898 [inline] __se_sys_mount+0x66b/0x810 fs/namespace.c:3875 __x64_sys_mount+0xe4/0x140 fs/namespace.c:3875 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b BUG: KMSAN: uninit-value in hfs_ext_read_extent fs/hfs/extent.c:196 [inline] BUG: KMSAN: uninit-value in hfs_get_block+0x92d/0x1620 fs/hfs/extent.c:366 hfs_ext_read_extent fs/hfs/extent.c:196 [inline] hfs_get_block+0x92d/0x1620 fs/hfs/extent.c:366 block_read_full_folio+0x4ff/0x11b0 fs/buffer.c:2271 hfs_read_folio+0x55/0x60 fs/hfs/inode.c:39 filemap_read_folio+0x148/0x4f0 mm/filemap.c:2426 do_read_cache_folio+0x7c8/0xd90 mm/filemap.c:3553 do_read_cache_page mm/filemap.c:3595 [inline] read_cache_page+0xfb/0x2f0 mm/filemap.c:3604 read_mapping_page include/linux/pagemap.h:755 [inline] hfs_btree_open+0x928/0x1ae0 fs/hfs/btree.c:78 hfs_mdb_get+0x260c/0x3000 fs/hfs/mdb.c:204 hfs_fill_super+0x1fb1/0x2790 fs/hfs/super.c:406 mount_bdev+0x628/0x920 fs/super.c:1359 hfs_mount+0xcd/0xe0 fs/hfs/super.c:456 legacy_get_tree+0x167/0x2e0 fs/fs_context.c:610 vfs_get_tree+0xdc/0x5d0 fs/super.c:1489 do_new_mount+0x7a9/0x16f0 fs/namespace.c:3145 path_mount+0xf98/0x26a0 fs/namespace.c:3475 do_mount fs/namespace.c:3488 [inline] __do_sys_mount fs/namespace.c:3697 [inline] __se_sys_mount+0x919/0x9e0 fs/namespace.c:3674 __ia32_sys_mount+0x15b/0x1b0 fs/namespace.c:3674 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178 do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246 entry_SYSENTER_compat_after_hwframe+0x70/0x82 Uninit was created at: __alloc_pages+0x9a6/0xe00 mm/page_alloc.c:4590 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] alloc_slab_page mm/slub.c:2190 [inline] allocate_slab mm/slub.c:2354 [inline] new_slab+0x2d7/0x1400 mm/slub.c:2407 ___slab_alloc+0x16b5/0x3970 mm/slub.c:3540 __slab_alloc mm/slub.c:3625 [inline] __slab_alloc_node mm/slub.c:3678 [inline] slab_alloc_node mm/slub.c:3850 [inline] kmem_cache_alloc_lru+0x64d/0xb30 mm/slub.c:3879 alloc_inode_sb include/linux/fs.h:3018 [inline] hfs_alloc_inode+0x5a/0xc0 fs/hfs/super.c:165 alloc_inode+0x83/0x440 fs/inode.c:260 new_inode_pseudo fs/inode.c:1005 [inline] new_inode+0x38/0x4f0 fs/inode.c:1031 hfs_new_inode+0x61/0x1010 fs/hfs/inode.c:186 hfs_mkdir+0x54/0x250 fs/hfs/dir.c:228 vfs_mkdir+0x49a/0x700 fs/namei.c:4126 do_mkdirat+0x529/0x810 fs/namei.c:4149 __do_sys_mkdirat fs/namei.c:4164 [inline] __se_sys_mkdirat fs/namei.c:4162 [inline] __x64_sys_mkdirat+0xc8/0x120 fs/namei.c:4162 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b It missed to initialize .tz_secondswest, .cached_start and .cached_blocks fields in struct hfs_inode_info after hfs_alloc_inode(), fix it.

AI Analysis

Technical Summary

CVE-2024-42311 is a vulnerability identified in the Linux kernel's HFS (Hierarchical File System) implementation. The issue arises from uninitialized fields within the hfs_inode_info structure after the function hfs_alloc_inode() is called. Specifically, the fields .tz_secondswest, .cached_start, and .cached_blocks were not properly initialized, leading to the use of uninitialized memory values. This was detected by KMSAN (Kernel Memory Sanitizer) during the revalidation of directory entries (hfs_revalidate_dentry) and while reading HFS extents (hfs_ext_read_extent) and blocks (hfs_get_block). The uninitialized memory usage can cause undefined behavior, including potential memory corruption or leakage of kernel memory contents. The vulnerability is rooted in the filesystem code paths that handle inode allocation and mounting operations for HFS volumes, which are primarily used to support Apple's HFS and HFS+ filesystems on Linux. The bug could be triggered during filesystem operations such as mounting, reading, or directory validation on HFS filesystems. Although the vulnerability does not have a CVSS score, the technical details indicate it is a memory safety issue that could lead to stability problems or information disclosure. No known exploits are reported in the wild as of the publication date. The fix involves properly initializing the affected fields in the hfs_inode_info structure immediately after inode allocation to prevent use of uninitialized data.

Potential Impact

For European organizations, the impact of CVE-2024-42311 depends largely on the extent to which HFS or HFS+ filesystems are used within their IT environments. HFS is not a common filesystem for Linux servers or desktops in Europe, as ext4, XFS, and Btrfs dominate Linux deployments. However, organizations that interact with Apple devices or legacy storage media formatted with HFS might mount such filesystems on Linux systems for data access or migration purposes. In such cases, exploitation of this vulnerability could lead to kernel memory leakage or instability, potentially allowing local attackers or malicious users with mount privileges to gain sensitive kernel information or cause denial of service. This could affect confidentiality and availability of affected systems. The vulnerability requires local access and the ability to mount or interact with HFS filesystems, limiting remote exploitation risk. Nonetheless, in environments where Linux systems are used as file servers or for forensic analysis involving HFS volumes, this vulnerability could be leveraged to escalate privileges or disrupt services. The absence of known exploits reduces immediate risk, but the vulnerability should be addressed to maintain kernel integrity and prevent future exploitation.

Mitigation Recommendations

1. Apply the official Linux kernel patches that initialize the hfs_inode_info fields correctly after hfs_alloc_inode(). Ensure that all Linux systems running kernels with HFS support are updated to versions containing this fix. 2. If patching is not immediately possible, restrict mounting of HFS filesystems to trusted users only, and monitor mount operations for suspicious activity. 3. Disable HFS filesystem support in the kernel if it is not required, by recompiling the kernel without HFS modules or blacklisting the hfs module to prevent accidental mounting. 4. Implement strict access controls and auditing on systems that handle external or legacy storage devices formatted with HFS to detect anomalous filesystem operations. 5. Use kernel memory sanitizers or runtime protections in development and testing environments to detect similar uninitialized memory issues proactively. 6. Educate system administrators about the risks associated with mounting legacy filesystems and encourage regular kernel updates as part of patch management policies.