CVE-2024-50230: Linux Kernel nilfs2 Bug Vulnerability

CVE-2024-50230 Overview

CVE-2024-50230 is a kernel vulnerability in the Linux kernel's nilfs2 filesystem that can trigger a kernel bug due to missing clearing of the "checked" flag during page/folio discard operations. When nilfs2 detects filesystem corruption and degrades to read-only mode, subsequent directory operations may cause __block_write_begin_int() to fail a BUG_ON check for accesses exceeding the folio/page size, resulting in a kernel panic.

The vulnerability was discovered through Syzbot, the automated kernel fuzzing system, which identified that the sanity check of directory entries was being skipped when directory pages were reloaded after being discarded by nilfs2's own page discard routine.

Critical Impact
Local attackers with low privileges can trigger a kernel bug leading to system crash and potential privilege escalation through memory corruption in the nilfs2 filesystem.

Affected Products

Linux Kernel versions prior to patched releases across multiple stable branches
Linux Kernel 6.12 release candidates (rc1 through rc5)
Systems utilizing nilfs2 filesystem for storage operations

Discovery Timeline

2024-11-09 - CVE-2024-50230 published to NVD
2025-11-03 - Last updated in NVD database

Technical Details for CVE-2024-50230

Vulnerability Analysis

This vulnerability exists in the nilfs2 filesystem's page management code. When nilfs2 encounters filesystem corruption, it transitions to read-only mode as a protective measure. However, a critical flaw exists in how the filesystem handles the "checked" flag on page/folio structures during this transition.

The "checked" flag is used by nilfs2 to indicate that directory entries on a particular page have been validated. When nilfs2's custom page discard routine releases pages, it fails to clear this flag. Subsequently, when the page is reloaded for directory operations, the filesystem incorrectly assumes the directory entries have already been validated because the stale "checked" flag persists.

This leads to corrupted or invalid directory entries being processed without proper sanity checks, eventually causing __block_write_begin_int() to encounter data that exceeds the expected folio/page size boundaries, triggering a kernel BUG_ON assertion and crashing the system.

Root Cause

The root cause is the failure to clear the "checked" flag in nilfs2's page discard routine when pages are released. This issue became critical when the nilfs2-specific page discard routine was applied to more than just metadata files, extending the scope of the vulnerability to directory operations. The CWE-787 (Out-of-Bounds Write) classification indicates that the memory corruption can result in writes beyond allocated buffer boundaries.

Attack Vector

The attack vector requires local access to the system with low privileges. An attacker would need the ability to:

Mount or access a nilfs2 filesystem
Trigger filesystem corruption detection (potentially through crafted filesystem images or race conditions)
Perform directory operations after the filesystem degrades to read-only mode

The vulnerability does not require user interaction and can be exploited to cause denial of service through kernel panic. Given the memory corruption nature of the bug (CWE-787), there is potential for more severe exploitation leading to privilege escalation.

The attack scenario involves manipulating nilfs2 filesystem state to exploit the improper flag handling. When the filesystem enters read-only mode due to detected corruption, subsequent directory read operations reload pages without proper validation, allowing corrupted directory entries to trigger the kernel bug through invalid memory access patterns.

Detection Methods for CVE-2024-50230

Indicators of Compromise

Kernel panic messages referencing __block_write_begin_int() BUG_ON failures
System crashes occurring during nilfs2 directory operations
Kernel logs showing nilfs2 filesystem corruption detection followed by system instability
Unexpected read-only filesystem remounts on nilfs2 volumes

Detection Strategies

Monitor kernel logs for nilfs2-related BUG_ON assertions and panic traces
Implement crash dump analysis to identify nilfs2 page handling failures
Deploy kernel auditing to track nilfs2 filesystem mount and directory operations
Use file integrity monitoring on systems with nilfs2 filesystems

Monitoring Recommendations

Enable kernel crash dump collection (kdump) to capture diagnostic information during kernel panics
Configure syslog alerting for nilfs2 filesystem warning and error messages
Monitor for unusual filesystem degradation patterns on nilfs2 volumes
Implement endpoint detection rules for kernel panic events associated with filesystem operations

How to Mitigate CVE-2024-50230

Immediate Actions Required

Update Linux kernel to patched versions as soon as available for your distribution
Consider migrating critical data from nilfs2 filesystems to alternative filesystems temporarily
Restrict local access to systems with nilfs2 filesystems to trusted users only
Monitor affected systems for signs of exploitation attempts

Patch Information

Multiple patches have been released across various Linux kernel stable branches. The fix ensures that the "checked" flag is properly cleared when nilfs2's page discard routine releases pages, preventing stale validation state from persisting across page reloads.

Patches are available through the following kernel git commits:

Debian users should refer to the Debian LTS security announcements for distribution-specific updates.

Workarounds

Avoid using nilfs2 filesystems on multi-user systems until patches are applied
If nilfs2 is required, restrict filesystem access permissions to minimize attack surface
Implement mandatory access controls (SELinux, AppArmor) to limit nilfs2 filesystem operations
Consider using alternative log-structured filesystems if nilfs2 is not strictly required

bash

# Check if nilfs2 is in use on your system
lsmod | grep nilfs2
mount | grep nilfs2

# If nilfs2 is not needed, blacklist the module
echo "blacklist nilfs2" >> /etc/modprobe.d/blacklist-nilfs2.conf

# Verify kernel version includes the fix
uname -r