CVE-2024-49958: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-49958 affects the Linux kernel's OCFS2 filesystem implementation. The vulnerability was discovered when a customer reported a crash and filesystem corruption. The issue lies in the reflink workflow while reserving space for inline extended attributes (xattr), specifically in the ocfs2reflinkxattr_inline() function. The vulnerability was disclosed in October 2024 and affects Linux kernel versions from 3.0.87 through 6.11.3 (NVD).

The vulnerability occurs when the reflink tree is recreated at the destination inode from the source inode. The ocfs2reflinkxattrinline() function attempts to reserve space for inline xattrs at the destination inode without checking if there is space available in the root metadata block. It reduces the lcount from 243 to 227 to make space of 256 bytes for inline xattr, even when the inode has extents beyond this index (up to 230), leading to corruption. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability can lead to filesystem corruption and system crashes. The issue specifically affects the OCFS2 filesystem's handling of extended attributes during reflink operations, potentially causing data integrity issues (Kernel Patch).

The vulnerability has been fixed by modifying the code to reserve space for inline metadata at the destination inode before the reflink tree gets recreated. The fix has been verified by the affected customer and is available through kernel updates. Multiple Linux distributions have released patches, including Ubuntu and Debian (Ubuntu Notice, Debian Notice).