nilfs2: fix missing cleanup on rollforward recovery error
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix missing cleanup on rollforward recovery error In an error injection test of a routine for mount-time recovery, KASAN found a use-after-free bug. It turned out that if data recovery was performed using partial logs created by dsync writes, but an error occurred before starting the log writer to create a recovered checkpoint, the inodes whose data had been recovered were left in the ns_dirty_files list of the nilfs object and were not freed. Fix this issue by cleaning up inodes that have read the recovery data if the recovery routine fails midway before the log writer starts.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- Linux Linux
Version range not reported
- Linux Linux
2.6.30
References 8
git.kernel.org
- stable/c/35a9a7a7d94662146396199b0cfd95f9517cdd14
- stable/c/da02f9eb333333b2e4f25d2a14967cff785ac82e
- stable/c/07e4dc2fe000ab008bcfe90be4324ef56b5b4355
- stable/c/8e2d1e9d93c4ec51354229361ac3373058529ec4
- stable/c/ca92c4bff2833cb30d493b935168d6cccd5c805d
- stable/c/9d8c3a585d564d776ee60d4aabec59b404be7403
- stable/c/1cf1f7e8cd47244fa947d357ef1f642d91e219a3
- stable/c/5787fcaab9eb5930f5378d6a1dd03d916d146622