{"timestamp":"2024-09-10T16:24:49.673152Z","id":"CVE-2024-41014","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/xfs/xfs_log_recover.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"d1e3efe783365db59da88f08a2e0bfe1cc95b143","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"7cd9f0a33e738cd58876f1bc8d6c1aa5bc4fc8c1","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"fb63435b7c7dc112b1ae1baea5486e0a6e27b196","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/xfs/xfs_log_recover.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"6.1.120","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.64","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.11","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]

https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE-125

OR
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 from (excluding) 6.6.64
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (excluding) 6.1.120
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 from (excluding) 6.11

CVE: https://git.kernel.org/stable/c/fb63435b7c7dc112b1ae1baea5486e0a6e27b196 Types: Mailing List, Patch

kernel.org: https://git.kernel.org/stable/c/7cd9f0a33e738cd58876f1bc8d6c1aa5bc4fc8c1 Types: Mailing List, Patch

kernel.org: https://git.kernel.org/stable/c/d1e3efe783365db59da88f08a2e0bfe1cc95b143 Types: Mailing List, Patch

kernel.org: https://git.kernel.org/stable/c/fb63435b7c7dc112b1ae1baea5486e0a6e27b196 Types: Mailing List, Patch

https://git.kernel.org/stable/c/d1e3efe783365db59da88f08a2e0bfe1cc95b143

https://git.kernel.org/stable/c/7cd9f0a33e738cd58876f1bc8d6c1aa5bc4fc8c1

https://git.kernel.org/stable/c/fb63435b7c7dc112b1ae1baea5486e0a6e27b196

In the Linux kernel, the following vulnerability has been resolved:

xfs: add bounds checking to xlog_recover_process_data

There is a lack of verification of the space occupied by fixed members
of xlog_op_header in the xlog_recover_process_data.

We can create a crafted image to trigger an out of bounds read by
following these steps:
    1) Mount an image of xfs, and do some file operations to leave records
    2) Before umounting, copy the image for subsequent steps to simulate
       abnormal exit. Because umount will ensure that tail_blk and
       head_blk are the same, which will result in the inability to enter
       xlog_recover_process_data
    3) Write a tool to parse and modify the copied image in step 2
    4) Make the end of the xlog_op_header entries only 1 byte away from
       xlog_rec_header->h_size
    5) xlog_rec_header->h_num_logops++
    6) Modify xlog_rec_header->h_crc

Fix:
Add a check to make sure there is sufficient space to access fixed members
of xlog_op_header.

kernel.org https://git.kernel.org/stable/c/fb63435b7c7dc112b1ae1baea5486e0a6e27b196 [No types assigned]