CVE-2024-42299: fs/ntfs3: Update log->page_{mask,bits} if log->page_size changed
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: Update log->page{mask,bits} if log->pagesize changed
If an NTFS file system is mounted to another system with different PAGESIZE from the original system, log->pagesize will change in logreplay(), but log->page{mask,bits} don't change correspondingly. This will cause a panic because "u32 bytes = log->pagesize - pageoff" will get a negative value in the later readlogpage().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42299?
CVE-2024-42299 has been classified with a severity rating that may vary depending on the context of the deployment.
How do I fix CVE-2024-42299?
To remediate CVE-2024-42299, upgrade your Linux kernel to versions 5.10.223-1, 5.10.234-1, 6.1.129-1, 6.1.128-1, or 6.12.17-1.
What is affected by CVE-2024-42299?
CVE-2024-42299 affects the Linux kernel when using the NTFS file system with differing PAGE_SIZE across systems.
How does CVE-2024-42299 impact system security?
CVE-2024-42299 could potentially lead to data integrity issues when NTFS file systems are mounted on systems with different configurations.
Which distributions are likely affected by CVE-2024-42299?
Debian-based distributions using the affected kernel versions are at risk of CVE-2024-42299.