CVE-2024-40952: 
CBL Mariner vulnerability analysis and mitigation

CVE-2024-40952 affects the Linux kernel's OCFS2 filesystem implementation. The vulnerability was discovered when bdev->bd_super was removed and replaced with b_assoc_map->host->i_sb in commit 8887b94d9322, introducing a NULL pointer dereference in ocfs2_journal_dirty() since b_assoc_map was not initialized. This issue can be reproduced by running xfstests generic/186, which simulates no more credits (NVD).

The vulnerability is a NULL pointer dereference (CWE-476) in the OCFS2 filesystem's journal handling code. The issue occurs in the ocfs2_journal_dirty() function when attempting to access b_assoc_map->host->i_sb while b_assoc_map is not initialized. The vulnerability has a CVSS v3.1 Base Score of 5.5 (MEDIUM) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

When triggered, the vulnerability causes a kernel NULL pointer dereference that results in a system crash, leading to a denial of service condition (NVD).

The vulnerability can be triggered locally by running xfstests generic/186, which simulates a condition where no more journal credits are available. The exploit requires local access and low privileges (Kernel Patch).

The issue has been fixed in the Linux kernel by modifying ocfs2_journal_dirty() to only abort the transaction and journal, while deferring the ocfs2_abort() call until an aborted handle is detected. The fix also includes improved logging of handle details (Kernel Patch).