CVE-2024-50218

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-50218
In the Linux kernel, the following vulnerability has been resolved: ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow Syzbot reported a kernel BUG in ocfs2_truncate_inline. There are two reasons for this: first, the parameter value passed is greater than ocfs2_max_inline_data_with_xattr, second, the start and end parameters of ocfs2_truncate_inline are "unsigned int". So, we need to add a sanity check for byte_start and byte_len right before ocfs2_truncate_inline() in ocfs2_remove_inode_range(), if they are greater than ocfs2_max_inline_data_with_xattr return -EINVAL.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0b6b8c2055784261de3fb641c5d0d63964318e8f Patch
https://git.kernel.org/stable/c/27d95867bee806cdc448d122bd99f1d8b0544035 Patch
https://git.kernel.org/stable/c/2fe5d62e122b040ce7fc4d31aa7fa96ae328cefc Patch
https://git.kernel.org/stable/c/70767689ec6ee5f05fb0a2c17d7ec1927946e486 Patch
https://git.kernel.org/stable/c/88f97a4b5843ce21c1286e082c02a5fb4d8eb473 Patch
https://git.kernel.org/stable/c/95fbed8ae8c32c0977e6be1721c190d8fea23f2f Patch
https://git.kernel.org/stable/c/bc0a2f3a73fcdac651fca64df39306d1e5ebe3b0 Patch
https://git.kernel.org/stable/c/ecd62f684386fa64f9c0cea92eea361f4e6444c2 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*
History

08 Oct 2025, 15:03

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/0b6b8c2055784261de3fb641c5d0d63964318e8f - () https://git.kernel.org/stable/c/0b6b8c2055784261de3fb641c5d0d63964318e8f - Patch
References () https://git.kernel.org/stable/c/27d95867bee806cdc448d122bd99f1d8b0544035 - () https://git.kernel.org/stable/c/27d95867bee806cdc448d122bd99f1d8b0544035 - Patch
References () https://git.kernel.org/stable/c/2fe5d62e122b040ce7fc4d31aa7fa96ae328cefc - () https://git.kernel.org/stable/c/2fe5d62e122b040ce7fc4d31aa7fa96ae328cefc - Patch
References () https://git.kernel.org/stable/c/70767689ec6ee5f05fb0a2c17d7ec1927946e486 - () https://git.kernel.org/stable/c/70767689ec6ee5f05fb0a2c17d7ec1927946e486 - Patch
References () https://git.kernel.org/stable/c/88f97a4b5843ce21c1286e082c02a5fb4d8eb473 - () https://git.kernel.org/stable/c/88f97a4b5843ce21c1286e082c02a5fb4d8eb473 - Patch
References () https://git.kernel.org/stable/c/95fbed8ae8c32c0977e6be1721c190d8fea23f2f - () https://git.kernel.org/stable/c/95fbed8ae8c32c0977e6be1721c190d8fea23f2f - Patch
References () https://git.kernel.org/stable/c/bc0a2f3a73fcdac651fca64df39306d1e5ebe3b0 - () https://git.kernel.org/stable/c/bc0a2f3a73fcdac651fca64df39306d1e5ebe3b0 - Patch
References () https://git.kernel.org/stable/c/ecd62f684386fa64f9c0cea92eea361f4e6444c2 - () https://git.kernel.org/stable/c/ecd62f684386fa64f9c0cea92eea361f4e6444c2 - Patch
First Time Linux
Linux linux Kernel
CPE cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*
CWE NVD-CWE-noinfo
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

12 Nov 2024, 13:56

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ocfs2: pasar u64 a ocfs2_truncate_inline puede provocar un desbordamiento Syzbot informó de un ERROR del kernel en ocfs2_truncate_inline. Hay dos razones para esto: primero, el valor del parámetro pasado es mayor que ocfs2_max_inline_data_with_xattr, segundo, los parámetros de inicio y fin de ocfs2_truncate_inline son "unsigned int". Por lo tanto, debemos agregar una comprobación de cordura para byte_start y byte_len justo antes de ocfs2_truncate_inline() en ocfs2_remove_inode_range(), si son mayores que ocfs2_max_inline_data_with_xattr devuelve -EINVAL.

09 Nov 2024, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-11-09 11:15

Updated : 2025-10-08 15:03

NVD link : CVE-2024-50218

Mitre link : CVE-2024-50218

CVE.ORG link : CVE-2024-50218

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo