CVE-2024-50218

ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow

Description

In the Linux kernel, the following vulnerability has been resolved: ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow Syzbot reported a kernel BUG in ocfs2_truncate_inline. There are two reasons for this: first, the parameter value passed is greater than ocfs2_max_inline_data_with_xattr, second, the start and end parameters of ocfs2_truncate_inline are "unsigned int". So, we need to add a sanity check for byte_start and byte_len right before ocfs2_truncate_inline() in ocfs2_remove_inode_range(), if they are greater than ocfs2_max_inline_data_with_xattr return -EINVAL.

N/A

CVSS

Severity:

EPSS 0.15%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/27d95867bee806cdc448d122bd99f1d8b0544035
https://git.kernel.org/stable/c/95fbed8ae8c32c0977e6be1721c190d8fea23f2f
https://git.kernel.org/stable/c/70767689ec6ee5f05fb0a2c17d7ec1927946e486
https://git.kernel.org/stable/c/ecd62f684386fa64f9c0cea92eea361f4e6444c2
https://git.kernel.org/stable/c/2fe5d62e122b040ce7fc4d31aa7fa96ae328cefc
https://git.kernel.org/stable/c/88f97a4b5843ce21c1286e082c02a5fb4d8eb473
https://git.kernel.org/stable/c/0b6b8c2055784261de3fb641c5d0d63964318e8f
https://git.kernel.org/stable/c/bc0a2f3a73fcdac651fca64df39306d1e5ebe3b0

Frequently Asked Questions

What is the severity of CVE-2024-50218?: CVE-2024-50218 has not yet been assigned a CVSS score.
How to fix CVE-2024-50218?: To fix CVE-2024-50218, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-50218 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2024-50218 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-50218?: CVE-2024-50218 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.