CVE-2024-41013

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-41013
In the Linux kernel, the following vulnerability has been resolved: xfs: don't walk off the end of a directory data block This adds sanity checks for xfs_dir2_data_unused and xfs_dir2_data_entry to make sure don't stray beyond valid memory region. Before patching, the loop simply checks that the start offset of the dup and dep is within the range. So in a crafted image, if last entry is xfs_dir2_data_unused, we can change dup->length to dup->length-1 and leave 1 byte of space. In the next traversal, this space will be considered as dup or dep. We may encounter an out of bound read when accessing the fixed members. In the patch, we make sure that the remaining bytes large enough to hold an unused entry before accessing xfs_dir2_data_unused and xfs_dir2_data_unused is XFS_DIR2_DATA_ALIGN byte aligned. We also make sure that the remaining bytes large enough to hold a dirent with a single-byte name before accessing xfs_dir2_data_entry.

7.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0c7fcdb6d06cdf8b19b57c17605215b06afa864a Patch
https://git.kernel.org/stable/c/b0932e4f9da85349d1c8f2a77d2a7a7163b8511d Patch
https://git.kernel.org/stable/c/ca96d83c93071f95cf962ce92406621a472df31b Patch
https://git.kernel.org/stable/c/0c7fcdb6d06cdf8b19b57c17605215b06afa864a Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

25 Sep 2025, 20:08

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/0c7fcdb6d06cdf8b19b57c17605215b06afa864a - () https://git.kernel.org/stable/c/0c7fcdb6d06cdf8b19b57c17605215b06afa864a - Patch
References () https://git.kernel.org/stable/c/b0932e4f9da85349d1c8f2a77d2a7a7163b8511d - () https://git.kernel.org/stable/c/b0932e4f9da85349d1c8f2a77d2a7a7163b8511d - Patch
References () https://git.kernel.org/stable/c/ca96d83c93071f95cf962ce92406621a472df31b - () https://git.kernel.org/stable/c/ca96d83c93071f95cf962ce92406621a472df31b - Patch
CWE CWE-125
First Time Linux
Linux linux Kernel
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.1

27 Jun 2025, 11:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/b0932e4f9da85349d1c8f2a77d2a7a7163b8511d -

27 Dec 2024, 14:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/ca96d83c93071f95cf962ce92406621a472df31b -

21 Nov 2024, 09:32

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/0c7fcdb6d06cdf8b19b57c17605215b06afa864a - () https://git.kernel.org/stable/c/0c7fcdb6d06cdf8b19b57c17605215b06afa864a -

29 Jul 2024, 14:12

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: xfs: no salga del final de un bloque de datos de directorio. Esto agrega controles de sanitización para xfs_dir2_data_unused y xfs_dir2_data_entry para asegurarse de que no se desvíen más allá de la región de memoria válida. Antes de parchear, el bucle simplemente verifica que el desplazamiento inicial de dup y dep esté dentro del rango. Entonces, en una imagen manipulada, si la última entrada es xfs_dir2_data_unused, podemos cambiar dup->length a dup->length-1 y dejar 1 byte de espacio. En el próximo recorrido, este espacio se considerará dup o dep. Es posible que nos encontremos con una lectura fuera de los límites al acceder a los miembros fijos. En el parche, nos aseguramos de que los bytes restantes sean lo suficientemente grandes como para contener una entrada no utilizada antes de acceder a xfs_dir2_data_unused y xfs_dir2_data_unused estén alineados con los bytes XFS_DIR2_DATA_ALIGN. También nos aseguramos de que los bytes restantes sean lo suficientemente grandes como para contener un directorio con un nombre de un solo byte antes de acceder a xfs_dir2_data_entry.

29 Jul 2024, 07:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-29 07:15

Updated : 2025-09-25 20:08

NVD link : CVE-2024-41013

Mitre link : CVE-2024-41013

CVE.ORG link : CVE-2024-41013

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-125

Out-of-bounds Read