CVE-2024-41016: ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: strict bound check before memcmp in ocfs2xattrfindentry()
xattr in ocfs2 maybe 'non-indexed', which saved with additional space requested. It's better to check if the memory is out of bound before memcmp, although this possibility mainly comes from crafted poisonous images.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41016?
CVE-2024-41016 has a severity rating that indicates a moderate risk level, primarily due to its potential impact on data integrity.
How do I fix CVE-2024-41016?
To resolve CVE-2024-41016, update the Linux kernel to the patched versions: 6.1.123-1, 6.1.119-1, 6.12.11-1, or 6.12.12-1.
Which Linux kernel versions are affected by CVE-2024-41016?
CVE-2024-41016 affects Linux kernel versions up to 5.10.226-1, including 5.10.223-1.
What symptoms may indicate an exploit of CVE-2024-41016?
Symptoms of an exploit related to CVE-2024-41016 may include unexpected system behavior or data corruption related to OCFS2 file system operations.
Is CVE-2024-41016 specific to any Linux distribution?
CVE-2024-41016 is particularly relevant to Debian-based distributions, especially those using the affected Linux kernel versions.