CVE-2024-41013 xfs: don't walk off the end of a directory data block
A crafted XFS image can cause an out-of-bounds read in the Linux kernel, potentially leading to denial of service or information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-41013?
CVE-2024-41013 is a high-severity memory corruption vulnerability in Linux kernel, published on 29 Jul 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
xfs: don't walk off the end of a directory data block
This adds sanity checks for xfs_dir2_data_unused and xfs_dir2_data_entry to make sure don't stray beyond valid memory region. Before patching, the loop simply checks that the start offset of the dup and dep is within the range. So in a crafted image, if last entry is xfs_dir2_data_unused, we can change dup->length to dup->length-1 and leave 1 byte of space. In the next traversal, this space will be considered as dup or dep. We may encounter an out of bound read when accessing the fixed members.
In the patch, we make sure that the remaining bytes large enough to hold an unused entry before accessing xfs_dir2_data_unused and xfs_dir2_data_unused is XFS_DIR2_DATA_ALIGN byte aligned. We also make sure that the remaining bytes large enough to hold a dirent with a single-byte name before accessing xfs_dir2_data_entry.
Weakness: CWE-125
Which versions are affected by CVE-2024-41013?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-41013?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-41013 being exploited?
There is no known exploitation of CVE-2024-41013 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-67770, BELL-CVE-2024-41013, DEBIAN-CVE-2024-41013, GHSA-mr66-qfpc-4h9r, ROOT-OS-DEBIAN-11-CVE-2024-41013, ROOT-OS-DEBIAN-12-CVE-2024-41013 and 2 more.