CVE-2024-53101 fs: Fix uninitialized value issue in from_kuid and from_kgid
An uninitialized value issue in the Linux kernel's OCFS2 filesystem allows attackers to potentially read sensitive memory contents via trace points.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-53101?
CVE-2024-53101 is a medium-severity vulnerability in Linux kernel, published on 25 Nov 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
fs: Fix uninitialized value issue in from_kuid and from_kgid
ocfs2_setattr() uses attr->ia_mode, attr->ia_uid and attr->ia_gid in a trace point even though ATTR_MODE, ATTR_UID and ATTR_GID aren't set.
Initialize all fields of newattrs to avoid uninitialized variables, by checking if ATTR_MODE, ATTR_UID, ATTR_GID are initialized, otherwise 0.
Weakness: CWE-908
Which versions are affected by CVE-2024-53101?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-53101?
Apply the vendor's patch.
Is CVE-2024-53101 being exploited?
There is no known exploitation of CVE-2024-53101 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-53101, DEBIAN-CVE-2024-53101, GHSA-jj65-jvhx-4h6p, UBUNTU-CVE-2024-53101.