high
7.1
CWE
125
Advisory Published
Updated

CVE-2024-41014: xfs: add bounds checking to xlog_recover_process_data

First published: Mon Jul 29 2024(Updated: )

In the Linux kernel, the following vulnerability has been resolved: xfs: add bounds checking to xlog_recover_process_data There is a lack of verification of the space occupied by fixed members of xlog_op_header in the xlog_recover_process_data. We can create a crafted image to trigger an out of bounds read by following these steps: 1) Mount an image of xfs, and do some file operations to leave records 2) Before umounting, copy the image for subsequent steps to simulate abnormal exit. Because umount will ensure that tail_blk and head_blk are the same, which will result in the inability to enter xlog_recover_process_data 3) Write a tool to parse and modify the copied image in step 2 4) Make the end of the xlog_op_header entries only 1 byte away from xlog_rec_header->h_size 5) xlog_rec_header->h_num_logops++ 6) Modify xlog_rec_header->h_crc Fix: Add a check to make sure there is sufficient space to access fixed members of xlog_op_header.

Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Affected SoftwareAffected VersionHow to fix
redhat/kernel<6.11
6.11
Linux Kernel<6.1.120
Linux Kernel>=6.2<6.6.64
Linux Kernel>=6.7<6.11
IBM Security Verify Governance - Identity Manager<=ISVG 10.0.2
IBM Security Verify Governance, Identity Manager Software Stack<=ISVG 10.0.2
IBM Security Verify Governance, Identity Manager Virtual Appliance<=ISVG 10.0.2
IBM Security Verify Governance Identity Manager Container<=ISVG 10.0.2

Remedy

https://git.kernel.org/stable/c/7cd9f0a33e738cd58876f1bc8d6c1aa5bc4fc8c1

Remedy

https://git.kernel.org/stable/c/d1e3efe783365db59da88f08a2e0bfe1cc95b143

Remedy

https://git.kernel.org/stable/c/fb63435b7c7dc112b1ae1baea5486e0a6e27b196

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

Frequently Asked Questions

  • What is the severity of CVE-2024-41014?

    CVE-2024-41014 has been assigned a medium severity rating due to its potential impact on data integrity.

  • How do I fix CVE-2024-41014?

    To fix CVE-2024-41014, upgrade to the kernel version 6.11 or higher from Red Hat.

  • What type of systems are affected by CVE-2024-41014?

    CVE-2024-41014 affects systems running specific versions of the Linux kernel that utilize XFS file systems.

  • Is there a workaround for CVE-2024-41014?

    Currently, there is no known workaround for CVE-2024-41014; the suggested solution is to apply the version update.

  • What impact does CVE-2024-41014 have on system security?

    CVE-2024-41014 could allow for potential exploitation leading to unauthorized access or manipulation of data within affected systems.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203