CVE-2024-41014 xfs: add bounds checking to xlog_recover_process_data
A local attacker can trigger an out-of-bounds read in the Linux kernel XFS filesystem by mounting a crafted image, potentially causing a crash or leaking memory.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-41014?
CVE-2024-41014 is a high-severity memory corruption vulnerability in Linux kernel, published on 29 Jul 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In the Linux kernel, the following vulnerability has been resolved:
xfs: add bounds checking to xlog_recover_process_data
There is a lack of verification of the space occupied by fixed members of xlog_op_header in the xlog_recover_process_data.
We can create a crafted image to trigger an out of bounds read by following these steps: 1) Mount an image of xfs, and do some file operations to leave records 2) Before umounting, copy the image for subsequent steps to simulate abnormal exit. Because umount will ensure that tail_blk and head_blk are the same, which will result in the inability to enter xlog_recover_process_data 3) Write a tool to parse and modify the copied image in step 2 4) Make the end of the xlog_op_header entries only 1 byte away from xlog_rec_header->h_size 5) xlog_rec_header->h_num_logops++ 6) Modify xlog_rec_header->h_crc
Fix: Add a check to make sure there is sufficient space to access fixed members of xlog_op_header.
Weakness: CWE-125
Which versions are affected by CVE-2024-41014?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-41014?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-41014 being exploited?
There is no known exploitation of CVE-2024-41014 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-57782, BELL-CVE-2024-41014, DEBIAN-CVE-2024-41014, GHSA-jfpf-jvq3-6jwv, ROOT-OS-DEBIAN-11-CVE-2024-41014, ROOT-OS-UBUNTU-2204-CVE-2024-41014 and 1 more.