CVE-2024-57850 – A memory corruption vulnerability exists in the... (How to Fix)

Q: What is the severity of CVE-2024-57850?

CVE-2024-57850 has a CVSS score of 7.8 (HIGH). A memory corruption vulnerability exists in the Linux kernel's JFFS2 filesystem rtime decompression routine. This allows attackers with access to corrupted compressed data to write beyond allocated buffer boundaries, potentially leading to system crashes or arbitrary code execution. All Linux systems using JFFS2 filesystems are affected.

📋 TL;DR

A memory corruption vulnerability exists in the Linux kernel's JFFS2 filesystem rtime decompression routine. This allows attackers with access to corrupted compressed data to write beyond allocated buffer boundaries, potentially leading to system crashes or arbitrary code execution. All Linux systems using JFFS2 filesystems are affected.

💻 Affected Systems

Products:

Linux kernel

Versions: All versions with JFFS2 support before the fix commits

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems using JFFS2 filesystems. Many embedded devices use JFFS2 for flash storage.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic, system crash, or arbitrary code execution with kernel privileges leading to complete system compromise.

🟠

Likely Case

System instability, crashes, or denial of service when processing malicious JFFS2 compressed files.

🟢

If Mitigated

Limited to denial of service if kernel hardening features like KASLR and SMAP are enabled.

🌐 Internet-Facing: LOW - Requires local filesystem access or ability to mount JFFS2 filesystems.

🏢 Internal Only: MEDIUM - Local users or processes with JFFS2 filesystem access could exploit this vulnerability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires ability to write corrupted compressed data to JFFS2 filesystem. No public exploits known at this time.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits 421f9e9f0fae9f8e721ffa07f22d9765fa1214d5 or later

Vendor Advisory: https://git.kernel.org/stable/c/421f9e9f0fae9f8e721ffa07f22d9765fa1214d5

Restart Required: No

Instructions:

1. Update Linux kernel to patched version from your distribution. 2. For embedded systems: Rebuild kernel with patches from stable tree. 3. No reboot required if using live kernel patching (kpatch/kgraft).

🔧 Temporary Workarounds

Disable JFFS2 filesystem

all

Prevent mounting or using JFFS2 filesystems to eliminate attack surface

modprobe -r jffs2
echo 'blacklist jffs2' > /etc/modprobe.d/blacklist-jffs2.conf

🧯 If You Can't Patch

Restrict access to JFFS2 filesystems to trusted users only
Implement strict file upload validation for systems processing JFFS2 compressed data

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if JFFS2 module is loaded: uname -r && lsmod | grep jffs2

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits or check with: grep -r 'rtime.*decompress' /proc/kallsyms

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
JFFS2 decompression errors in dmesg
System crash reports

Network Indicators:

None - local filesystem vulnerability

SIEM Query:

source="kernel" AND ("jffs2" OR "rtime" OR "decompress") AND ("panic" OR "corrupt" OR "oops")

📊 Metadata

CVE ID: CVE-2024-57850

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-787

EPSS Score: 0.04% exploit probability (12.6th percentile)

Published: January 11, 2025

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-57850, you might also want to check these: