CVE-2024-40951: 
CBL Mariner vulnerability analysis and mitigation

CVE-2024-40951 affects the Linux kernel's OCFS2 filesystem implementation. The vulnerability was discovered when bdev->bd_super was removed and commit 8887b94d9322 changed the usage from bdev->bd_super to b_assoc_map->host->i_sb. Since OCFS2 hasn't set bh->b_assoc_map, it triggers a NULL pointer dereference when calling into ocfs2_abort_trigger() (Kernel Patch).

The vulnerability is a NULL pointer dereference issue in the OCFS2 filesystem code. The problem occurs in the ocfs2_abort_trigger() function where bh->b_assoc_map->host->i_sb is accessed without proper NULL checks. This was introduced as a regression when the code was changed to stop using bdev->bd_super for journal error logging. The CVSS v3.1 base score is 5.5 (MEDIUM) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability can cause a denial of service condition through a kernel crash due to the NULL pointer dereference. The issue affects systems running Linux kernel versions from 6.6 up to (excluding) 6.6.36, versions from 6.7 up to (excluding) 6.9.7, and release candidates 6.10-rc1 through 6.10-rc4 (NVD).

The vulnerability requires local access and low privileges to exploit. It can be triggered through normal filesystem operations when using the OCFS2 filesystem with certain configurations (NVD).

The issue has been fixed in Linux kernel versions 6.6.36, 6.9.7, and later. The fix involves initializing all types of OCFS2 triggers when filling the superblock, and then getting the specific OCFS2 trigger from ocfs2_caching_info when accessing the journal (Kernel Patch).