{"id":"CVE-2024-47699","revision":"c4d305dcdaa34324b4227f1e54985704","records":[{"revision":"c4d305dcdaa34324b4227f1e54985704","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2024-47699","aliases":[],"title":"nilfs2: fix potential null-ptr-deref in nilfs_btree_insert()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix potential null-ptr-deref in nilfs_btree_insert()\n\nPatch series \"nilfs2: fix potential issues with empty b-tree nodes\".\n\nThis series addresses three potential issues with empty b-tree nodes that\ncan occur with corrupted filesystem images, including one recently\ndiscovered by syzbot.\n\n\nThis patch (of 3):\n\nIf a b-tree is broken on the device, and the b-tree height is greater than\n2 (the level of the root node is greater than 1) even if the number of\nchild nodes of the b-tree root is 0, a NULL pointer dereference occurs in\nnilfs_btree_prepare_insert(), which is called from nilfs_btree_insert().\n\nThis is because, when the number of child nodes of the b-tree root is 0,\nnilfs_btree_do_lookup() does not set the block buffer head in any of\npath[x].bp_bh, leaving it as the initial value of NULL, but if the level\nof the b-tree root node is greater than 1, nilfs_btree_get_nonroot_node(),\nwhich accesses the buffer memory of path[x].bp_bh, is called.\n\nFix this issue by adding a check to nilfs_btree_root_broken(), which\nperforms sanity checks when reading the root node from the device, to\ndetect this inconsistency.\n\nThanks to Lizhi Xu for trying to solve the bug and clarifying the cause\nearly on.","state":0,"publishedAt":"2024-10-21T11:53:35.962+00:00","modifiedAt":"2026-10-15T00:51:46.202+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/nilfs2/btree.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"17c76b0104e4a6513983777e1a17e0297a12b0c4\",\n                            \"lessThan\": \"2b78e9df10fb7f4e9d3d7a18417dd72fbbc1dfd0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"17c76b0104e4a6513983777e1a17e0297a12b0c4\",\n                            \"lessThan\": \"1d94dbdfbb64cc48d10dec65cc3c4fbf2497b343\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"17c76b0104e4a6513983777e1a17e0297a12b0c4\",\n                            \"lessThan\": \"24bf40740a3da6b4056721da34997ae6938f3da1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"17c76b0104e4a6513983777e1a17e0297a12b0c4\",\n                            \"lessThan\": \"73d23ecf234b7a6d47fb883f2dabe10e3230b31d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"17c76b0104e4a6513983777e1a17e0297a12b0c4\",\n                            \"lessThan\": \"f68523e0f26faade18833fbef577a4295d8e2c94\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"17c76b0104e4a6513983777e1a17e0297a12b0c4\",\n                            \"lessThan\": \"21839b6fbc3c41b3e374ecbdb0cabbbb2c53cf34\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"17c76b0104e4a6513983777e1a17e0297a12b0c4\",\n                            \"lessThan\": \"db73500d3f0e558eb642aae1d4782e7726b4a03f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"17c76b0104e4a6513983777e1a17e0297a12b0c4\",\n                            \"lessThan\": \"3644554d308ddf2669e459a1551a7edf60b2d62b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"17c76b0104e4a6513983777e1a17e0297a12b0c4\",\n                            \"lessThan\": \"9403001ad65ae4f4c5de368bdda3a0636b51d51a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/nilfs2/btree.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"2.6.30\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"2.6.30\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"4.19.323\",\n                            \"lessThanOrEqual\": \"4.19.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.4.285\",\n                            \"lessThanOrEqual\": \"5.4.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.227\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.168\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.113\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.54\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.10.13\",\n                            \"lessThanOrEqual\": \"6.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.11.2\",\n                            \"lessThanOrEqual\": \"6.11.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/2b78e9df10fb7f4e9d3d7a18417dd72fbbc1dfd0","https://git.kernel.org/stable/c/1d94dbdfbb64cc48d10dec65cc3c4fbf2497b343","https://git.kernel.org/stable/c/24bf40740a3da6b4056721da34997ae6938f3da1","https://git.kernel.org/stable/c/73d23ecf234b7a6d47fb883f2dabe10e3230b31d","https://git.kernel.org/stable/c/f68523e0f26faade18833fbef577a4295d8e2c94","https://git.kernel.org/stable/c/21839b6fbc3c41b3e374ecbdb0cabbbb2c53cf34","https://git.kernel.org/stable/c/db73500d3f0e558eb642aae1d4782e7726b4a03f","https://git.kernel.org/stable/c/3644554d308ddf2669e459a1551a7edf60b2d62b","https://git.kernel.org/stable/c/9403001ad65ae4f4c5de368bdda3a0636b51d51a"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-47699","license":"CVE Program Terms of Use","key":"cve-program:CVE-2024-47699","identifiers":["CVE-2024-47699"]},"retained":false,"historicalAffected":[]}],"coverage":[]}