CVE-2024-53147CWE-125

CVE-2024-53147

High · published December 24, 2024

CVSS v3.1
7.8
EPSS
0%
Percentile
11.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

exfat: fix out-of-bounds access of directory entries

In the case of the directory size is greater than or equal to

the cluster size, if start_clu becomes an EOF cluster(an invalid

cluster) due to file system corruption, then the directory entry

where ei->hint_femp.eidx hint is outside the directory, resulting

in an out-of-bounds access, which may cause further file system

corruption.

This commit adds a check for start_clu, if it is an invalid cluster,

the file or directory will be treated as empty.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00217 · 11.5th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2024-12-24T17:15Z
Affected products (2)
ProductVersionsFixed in
linux/linux_kernel≥ 5.7, < 6.11.116.11.11
linux/linux_kernel≥ 6.12, < 6.12.26.12.2
References (4)
EPSS history
Timeline
  • 24 DEC 11:28Z
    exfat: fix out-of-bounds access of directory entries
    cvelistv5