IM
IronMonkey Threat Research

CVE-2024-41016 HIGH

Published: 2024-07-29 | Last Modified: 2026-08-04 | Status: Modified

Description

In the Linux kernel, the following vulnerability has been resolved: ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry() xattr in ocfs2 maybe 'non-indexed', which saved with additional space requested. It's better to check if the memory is out of bound before memcmp, although this possibility mainly comes from crafted poisonous images.

Additional Descriptions (1)

En el kernel de Linux, se resolvió la siguiente vulnerabilidad: ocfs2: verificación de límite estricto antes de memcmp en ocfs2_xattr_find_entry() xattr en ocfs2 puede ser 'non-indexed', lo que se guardó con espacio adicional solicitado. Es mejor comprobar si la memoria está fuera de los límites antes de memcmp, aunque esta posibilidad proviene principalmente de imágenes venenosas creadas.

CVSS Metrics

Base Score: 5.5 (MEDIUM)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack VectorLOCAL
Attack ComplexityLOW
Privileges RequiredLOW
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 1.8

Impact Score: 3.6

Weaknesses

Source Type Description
[email protected] Primary
en NVD-CWE-noinfo

Affected Products

Vendor Product Version Update Type
linux linux_kernel * <built-in method update of dict object at 0x7fd3401fff40> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd3401feec0> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd36b50f880> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd360695040> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd369262500> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd36a2dc0c0> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd360697000> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

References