CVE-2024-42077

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: fix DIO failure due to insufficient transaction credits

The code in ocfs2_dio_end_io_write() estimates number of necessary

transaction credits using ocfs2_calc_extend_credits(). This however does

not take into account that the IO could be arbitrarily large and can

contain arbitrary number of extents.

Extent tree manipulations do often extend the current transaction but not

in all of the cases. For example if we have only single block extents in

the tree, ocfs2_mark_extent_written() will end up calling

ocfs2_replace_extent_rec() all the time and we will never extend the

current transaction and eventually exhaust all the transaction credits if

the IO contains many single block extents. Once that happens a

WARN_ON(jbd2_handle_buffer_credits(handle) <= 0) is triggered in

jbd2_journal_dirty_metadata() and subsequently OCFS2 aborts in response to

this error. This was actually triggered by one of our customers o

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References