CVE-2024-47670
In the Linux kernel, the following vulnerability has been resolved: ocfs2: add bounds checking to ocfs2_xattr_find_entry() Add a paranoia check to make sure it doesn't stray beyond valid memory region containing ocfs2 xattr entries when scanning for a…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.24%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
In the Linux kernel, the following vulnerability has been resolved: ocfs2: add bounds checking to ocfs2_xattr_find_entry() Add a paranoia check to make sure it doesn't stray beyond valid memory region containing ocfs2 xattr entries when scanning for a match. It will prevent out-of-bound access in case of crafted images.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.24% probability · 15th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-787
- Affected
- linux/linux kernel
- Source
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
References
- https://git.kernel.org/stable/c/1f6e167d6753fe3ea493cdc7f7de8d03147a4d39Patch
- https://git.kernel.org/stable/c/34759b7e4493d7337cbc414c132cef378c492a2cPatch
- https://git.kernel.org/stable/c/5bbe51eaf01a5dd6fb3f0dea81791e5dbc6dc6ddPatch
- https://git.kernel.org/stable/c/60c0d36189bad58b1a8e69af8781d90009559ea1
- https://git.kernel.org/stable/c/8e7bef408261746c160853fc27df3139659f5f77Patch
- https://git.kernel.org/stable/c/9b32539590a8e6400ac2f6e7cf9cbb8e08711a2fPatch
- https://git.kernel.org/stable/c/9e3041fecdc8f78a5900c3aa51d3d756e73264d6Patch
- https://git.kernel.org/stable/c/b49a786beb11ff740cb9e0c20b999c2a0e1729c2
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.