CVE-2024-43859: 
CBL Mariner vulnerability analysis and mitigation

CVE-2024-43859 affects the Linux kernel's F2FS (Flash-Friendly File System) implementation. The vulnerability was discovered by chenyuwen and involves a NULL pointer dereference issue that occurs during the handling of preallocated blocks in the file system. The issue specifically manifests when inode.i_crypt_info is not properly initialized during certain mount operations (NVD).

The vulnerability is caused by a NULL pointer dereference at virtual address 0x11 in the F2FS filesystem code path during mount operations. The issue occurs specifically in the sequence: mount -> f2fs_fill_super -> f2fs_disable_checkpoint -> f2fs_gc -> f2fs_iget -> f2fs_truncate, where inode.i_crypt_info is not properly initialized. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to a kernel NULL pointer dereference, potentially resulting in a system crash or denial of service condition. The impact is limited to local attacks and requires local user privileges to exploit (NVD).

The vulnerability requires local access and low privileges to exploit. It has been confirmed to be exploitable through specific mount operations in the F2FS filesystem (Kernel Patch).

The issue has been fixed in the Linux kernel by relocating the truncation of preallocated blocks to f2fs_file_open(), after fscrypt_file_open(). The fix has been backported to various kernel versions including Ubuntu 24.04 LTS (kernel 6.8.0-50.51) and other distributions. Users should update their systems to the patched kernel versions (Ubuntu).