CVE-2024-41019: fs/ntfs3: Validate ff offset
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: Validate ff offset
This adds sanity checks for ff offset. There is a check on rt->firstfree at first, but walking through by ff without any check. If the second ff is a large offset. We may encounter an out-of-bound read.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41019?
CVE-2024-41019 has not been assigned a CVSS severity score yet.
How do I fix CVE-2024-41019?
To fix CVE-2024-41019, update the Linux kernel to one of the patched versions such as 5.10.223-1, 6.1.119-1, or newer.
What software is affected by CVE-2024-41019?
CVE-2024-41019 affects specific versions of the Linux kernel, including debian/linux and debian/linux-6.1 packages.
What type of vulnerability is CVE-2024-41019?
CVE-2024-41019 is a vulnerability related to offset validation within the NTFS file system support in the Linux kernel.
Is CVE-2024-41019 exploitable?
Yes, CVE-2024-41019 can potentially be exploited if the validation checks are bypassed.