Lucene search

K
vulnrichmentLinuxVULNRICHMENT:CVE-2024-41014
HistoryJul 29, 2024 - 6:37 a.m.

CVE-2024-41014 xfs: add bounds checking to xlog_recover_process_data

2024-07-2906:37:00
Linux
github.com
2
linux kernel
xfs
bounds checking
vulnerability
out of bounds read
crafted image
umount
abnormal exit
xlog_op_header
h_num_logops
h_crc
cve-2024-41014
fix
space verification

AI Score

6.6

Confidence

Low

SSVC

Exploitation

none

Automatable

no

Technical Impact

partial

In the Linux kernel, the following vulnerability has been resolved:

xfs: add bounds checking to xlog_recover_process_data

There is a lack of verification of the space occupied by fixed members
of xlog_op_header in the xlog_recover_process_data.

We can create a crafted image to trigger an out of bounds read by
following these steps:
1) Mount an image of xfs, and do some file operations to leave records
2) Before umounting, copy the image for subsequent steps to simulate
abnormal exit. Because umount will ensure that tail_blk and
head_blk are the same, which will result in the inability to enter
xlog_recover_process_data
3) Write a tool to parse and modify the copied image in step 2
4) Make the end of the xlog_op_header entries only 1 byte away from
xlog_rec_header->h_size
5) xlog_rec_header->h_num_logops++
6) Modify xlog_rec_header->h_crc

Fix:
Add a check to make sure there is sufficient space to access fixed members
of xlog_op_header.

AI Score

6.6

Confidence

Low

SSVC

Exploitation

none

Automatable

no

Technical Impact

partial