CVE-2024-42257 ext4: use memtostr_pad() for s_volume_name
A missing null termination in ext4 volume name handling could allow reading adjacent memory, potentially disclosing sensitive kernel data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-42257?
CVE-2024-42257 is a high-severity vulnerability in Linux kernel, published on 8 Aug 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ext4: use memtostr_pad() for s_volume_name
As with the other strings in struct ext4_super_block, s_volume_name is not NUL terminated. The other strings were marked in commit 072ebb3bffe6 ("ext4: add nonstring annotations to ext4.h"). Using strscpy() isn't the right replacement for strncpy(); it should use memtostr_pad() instead.
Which versions are affected by CVE-2024-42257?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-42257?
Apply the vendor's patch.
Is CVE-2024-42257 being exploited?
There is no known exploitation of CVE-2024-42257 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-42257, GHSA-xc8j-8q2q-h32f, UBUNTU-CVE-2024-42257.