Listen to this Post
The vulnerability CVE-2025-38328 is a null pointer dereference flaw in the Linux kernel’s JFFS2 flash filesystem. The issue occurs in the `jffs2_prealloc_raw_node_refs()` function, which can fail to allocate memory and return a NULL pointer. The calling code, specifically within `jffs2_link_node_ref()` and related functions in the garbage collector (jffs2_erase_pending_blocks), did not properly check this return value. Subsequent logic incorrectly assumed the allocation was successful and proceeded to dereference the expected pointer. This leads to a kernel oops or system crash when attempting to access the invalid memory address in the range [0x0000000000000008-0x000000000000000f]. The flaw is triggered during filesystem maintenance operations like garbage collection and space reservation, often initiated by write operations. Attackers could potentially exploit this by manipulating the JFFS2 filesystem to induce allocation failure at a critical point, causing a denial of service by crashing the kernel.
Platform: Linux Kernel
Version: 5.10.234
Vulnerability: Null Pointer Dereference
Severity: Critical
date: July 10, 2025
Prediction: November 2025
What Undercode Say:
Analytics
syz-manager --config my.cfg syz-runner -kernel=~/linux -sshkey=~/key cat /proc/kmsg | grep "KASAN: null-ptr-deref" dmesg | grep "jffs2" git log --oneline --grep="jffs2_prealloc"
How Exploit
1. Craft a malicious JFFS2 filesystem image.
2. Mount the image on a vulnerable kernel.
- Force high memory pressure or fragmented flash layout.
4. Trigger intensive write/garbage collection activity.
5. Cause `jffs2_prealloc_raw_node_refs()` to fail and return NULL.
6. Trigger subsequent code path in `jffs2_erase_pending_blocks`.
7. Kernel attempts to dereference NULL pointer.
8. System crashes with kernel oops/panic.
Protection from this CVE
1. Apply kernel patch checking `jffs2_prealloc_raw_node_refs()` result.
2. Update to kernel version containing the fix.
3. Backport the specific commit to stable kernels.
4. Avoid using JFFS2 on untrusted flash media.
5. Restrict user access to mount JFFS2 filesystems.
6. Monitor kernel logs for JFFS2 allocation errors.
Impact
Kernel panic denial of service system instability data loss integrity compromise
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
