CVE-2024-57850
Published: 11 January 2025
Summary
CVE-2024-57850 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 5.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-57850 is a vulnerability in the Linux kernel's JFFS2 filesystem implementation, specifically in the rtime decompression routine. This routine fails to perform complete bounds checking throughout the decompression process, allowing memory corruption outside the intended decompression buffer when processing corrupted compressed data. The issue is classified under CWE-787 (Out-of-bounds Write) and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant confidentiality, integrity, and availability impacts.
A local attacker with low privileges can exploit this vulnerability by supplying malformed compressed data to the JFFS2 rtime decompressor, such as through a crafted filesystem image or file. Successful exploitation leads to out-of-bounds memory writes, which could enable arbitrary code execution, privilege escalation, or system crashes, depending on the attacker's control over the corrupted data and the kernel's memory layout.
Mitigation is provided through patches in Linux kernel stable releases, as detailed in the referenced commits: 421f9e9f0fae9f8e721ffa07f22d9765fa1214d5, 47c9a7f81027a78afea9d2e9a54bfd8fabb6b3d0, 6808a1812a3419542223e7fe9e2de577e99e45d1, bd384b04ad1995441b18fe6c1366d02de8c5d5eb, and dc39b08fcc3831b0bc46add91ba93cd2aab50716. These commits add the necessary bounds checks to prevent memory corruption during decompression. Security practitioners should update affected kernel versions to incorporate these fixes.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-53774
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: jffs2: Prevent rtime decompress memory corruption The rtime decompression routine does not fully check bounds during the entirety of the decompression pass and can corrupt memory outside the decompression buffer…
more
if the compressed data is corrupted. This adds the required check to prevent this failure mode.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local kernel memory corruption in JFFS2 rtime decompressor directly enables privilege escalation via crafted filesystem data (CWE-787, AV:L/PR:L).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates timely patching of the Linux kernel to incorporate bounds checks that prevent memory corruption in the JFFS2 rtime decompression routine.
Requires validation of compressed data inputs to the JFFS2 decompressor to block malformed data from causing out-of-bounds writes.
Provides kernel memory protections like address space randomization to mitigate exploitation of out-of-bounds memory corruption.