cbcvebase.
CVE-2024-56548
published 2024-12-27

CVE-2024-56548: In the Linux kernel, the following vulnerability has been resolved: hfsplus: don't query the device logical block size multiple times Devices block sizes may…

PriorityP339high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.25%
16.1th percentile
In the Linux kernel, the following vulnerability has been resolved: hfsplus: don't query the device logical block size multiple times Devices block sizes may change. One of these cases is a loop device by using ioctl LOOP_SET_BLOCK_SIZE. While this may cause other issues like IO being rejected, in the case of hfsplus, it will allocate a block by using that size and potentially write out-of-bounds when hfsplus_read_wrapper calls hfsplus_submit_bio and the latter function reads a different io_size. Using a new min_io_size initally set to sb_min_blocksize works for the purposes of the original fix, since it will be set to the max between HFSPLUS_SECTOR_SIZE and the first seen logical block size. We still use the max between HFSPLUS_SECTOR_SIZE and min_io_size in case the latter is not initialized. Tested by mounting an hfsplus filesystem with loop block sizes 512, 1024 and 4096. The produced KASAN report before the fix looks like this: [ 419.944641] ================================================================== [ 419.945655] BUG: KASAN: slab-use-after-free in hfsplus_read_wrapper+0x659/0xa0a [ 419.946703] Read of size 2 at addr ffff88800721fc00 by task repro/10678 [ 419.947612] [ 419.947846] CPU: 0 UID: 0 PID: 10678 Comm: repro Not tainted 6.12.0-rc5-00008-gdf56e0f2f3ca #84 [ 419.949007] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 [ 419.950035] Call Trace: [ 419.950384] [ 419.950676] dump_stack_lvl+0x57/0x78 [ 419.951212] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.951830] print_report+0x14c/0x49e [ 419.952361] ? __virt_addr_valid+0x267/0x278 [ 419.952979] ? kmem_cache_debug_flags+0xc/0x1d [ 419.953561] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.954231] kasan_report+0x89/0xb0 [ 419.954748] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.955367] hfsplus_read_wrapper+0x659/0xa0a [ 419.955948] ? __pfx_hfsplus_read_wrapper+0x10/0x10 [ 419.956618] ? do_raw_spin_unlock+0x59/0x1a9 [ 419.957214] ? _raw_spin_unlock+0x1a/0x2e [ 419.957772] hfsplus

Affected

33 ranges· showing 25
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.123-1 (bookworm)linux 6.1.123-1 (bookworm)
debianlinux-6.1< linux 6.1.123-1 (bookworm)linux 6.1.123-1 (bookworm)
linuxlinux
linuxlinux
linuxlinux>= 3.0.8 < 3.13.1
linuxlinux>= 6596528e391ad978a6a120142cba97a1d7324cb6 < baccb5e12577b7a9eff54ffba301fdaa0f3ee5a8baccb5e12577b7a9eff54ffba301fdaa0f3ee5a8
linuxlinux>= 6596528e391ad978a6a120142cba97a1d7324cb6 < f57725bcc5816425e25218fdf5fb6923bc578cdff57725bcc5816425e25218fdf5fb6923bc578cdf
linuxlinux>= 6596528e391ad978a6a120142cba97a1d7324cb6 < e8a2b1c1c2ea85e9a5a2d0c5a5a7e7c639feb866e8a2b1c1c2ea85e9a5a2d0c5a5a7e7c639feb866
linuxlinux>= 6596528e391ad978a6a120142cba97a1d7324cb6 < 06cbfbb13ac88f4154c2eb4bc4176f9d1013984706cbfbb13ac88f4154c2eb4bc4176f9d10139847
linuxlinux>= 6596528e391ad978a6a120142cba97a1d7324cb6 < 3d7bda75e1a6239db053c73acde17ca1463178243d7bda75e1a6239db053c73acde17ca146317824
linuxlinux>= 6596528e391ad978a6a120142cba97a1d7324cb6 < 21900e8478126ff6afe3b66679f676e74d1f883021900e8478126ff6afe3b66679f676e74d1f8830
linuxlinux>= 6596528e391ad978a6a120142cba97a1d7324cb6 < 2667c9b7b76efcbc7adbfea249892f20c313b0da2667c9b7b76efcbc7adbfea249892f20c313b0da
linuxlinux>= 6596528e391ad978a6a120142cba97a1d7324cb6 < bfeecda050aa9376f642d5b2a71c4112cc6c8216bfeecda050aa9376f642d5b2a71c4112cc6c8216
linuxlinux>= 6596528e391ad978a6a120142cba97a1d7324cb6 < 1c82587cb57687de3f18ab4b98a8850c789bedcf1c82587cb57687de3f18ab4b98a8850c789bedcf
linuxlinux_kernel>= 0 < 5.10.234-15.10.234-1
linuxlinux_kernel>= 0 < 6.1.123-16.1.123-1
linuxlinux_kernel>= 0 < 6.12.3-16.12.3-1
linuxlinux_kernel>= 0 < 6.12.3-16.12.3-1
linuxlinux_kernel>= 0 < 5.4.0-211.2315.4.0-211.231
linuxlinux_kernel>= 0 < 5.15.0-135.1465.15.0-135.146
linuxlinux_kernel>= 0 < 6.8.0-58.606.8.0-58.60
linuxlinux_kernel>= 0 < 6.11.0-18.186.11.0-18.18
linuxlinux_kernel>= 0 < 4.4.0-278.3124.4.0-278.312
linuxlinux_kernel>= 0 < 4.15.0-247.2594.15.0-247.259
linuxlinux_kernel>= 3.0.8 < 4.19.3254.19.325

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv8.8HIGH
vendor_ubuntu8.8HIGH
vendor_debian7.8HIGH
vendor_msrc7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.