CVE-2024-47670 ocfs2: add bounds checking to ocfs2_xattr_find_entry()
A missing bounds check in the OCFS2 filesystem allows out-of-bounds access via crafted images, potentially leading to code execution or system crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-47670?
CVE-2024-47670 is a high-severity memory corruption vulnerability in Linux kernel, published on 9 Oct 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: add bounds checking to ocfs2_xattr_find_entry()
Add a paranoia check to make sure it doesn't stray beyond valid memory region containing ocfs2 xattr entries when scanning for a match. It will prevent out-of-bound access in case of crafted images.
Weakness: CWE-787
Which versions are affected by CVE-2024-47670?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-47670?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-47670 being exploited?
There is no known exploitation of CVE-2024-47670 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-50848, AZL-50903, BELL-CVE-2024-47670, DEBIAN-CVE-2024-47670, GHSA-qvvj-m5ww-3hcj, UBUNTU-CVE-2024-47670.