VYPR
← All advisories
High severity7.1NVD Advisory· Published Oct 21, 2024· Updated May 12, 2026

CVE-2024-49900

CVE-2024-49900

Description

In the Linux kernel, the following vulnerability has been resolved:

jfs: Fix uninit-value access of new_ea in ea_buffer

syzbot reports that lzo1x_1_do_compress is using uninit-value:

===================================================== BUG: KMSAN: uninit-value in lzo1x_1_do_compress+0x19f9/0x2510 lib/lzo/lzo1x_compress.c:178

...

Uninit was stored to memory at: ea_put fs/jfs/xattr.c:639 [inline]

...

Local variable ea_buf created at: __jfs_setxattr+0x5d/0x1ae0 fs/jfs/xattr.c:662 __jfs_xattr_set+0xe6/0x1f0 fs/jfs/xattr.c:934

=====================================================

The reason is ea_buf->new_ea is not initialized properly.

Fix this by using memset to empty its content at the beginning in ea_get().

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

An uninitialized memory access in the JFS xattr code of the Linux kernel could leak sensitive data or cause a denial of service.

Vulnerability

Overview

CVE-2024-49900 is an uninitialized value vulnerability in the JFS (Journaled File System) component of the Linux kernel. The bug resides in the ea_get() function within fs/jfs/xattr.c, where the ea_buf->new_ea field is not initialized before being used in ea_put(). This uninitialized memory is then passed to the LZO compression routine lzo1x_1_do_compress, which reads and processes it, potentially leading to information disclosure or a system crash [1][3][4].

Exploitation

Details

The issue can be triggered locally by an attacker who can invoke the __jfs_setxattr() or __jfs_xattr_set() system calls on a JFS filesystem. No special privileges are required beyond the ability to manipulate extended attributes. The uninitialized stack memory may contain kernel heap pointers or other sensitive data, which the LZO compressor would then act upon, potentially exposing that data to userspace or causing a denial of service due to corrupted compression state [2].

Impact and

Mitigation

If exploited, this vulnerability could allow an unprivileged local attacker to read kernel memory (information leak) or crash the system (denial of service). The official fix, introduced via commits [3] and [4], uses memset to zero-initialize the ea_buf structure at the beginning of ea_get(). Users should apply the latest stable kernel updates that include this patch. The vulnerability affects all versions of the Linux kernel prior to the fix, but a workaround is to avoid enabling JFS filesystems on untrusted systems.

References
  1. SSA-265688
  2. SSA-355557
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

106

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

13

News mentions

0

No linked articles in our index yet.