CVE-2024-53147 (GCVE-0-2024-53147)
Vulnerability from cvelistv5
Published
2024-12-24 11:28
Modified
2025-05-04 09:54
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: exfat: fix out-of-bounds access of directory entries In the case of the directory size is greater than or equal to the cluster size, if start_clu becomes an EOF cluster(an invalid cluster) due to file system corruption, then the directory entry where ei->hint_femp.eidx hint is outside the directory, resulting in an out-of-bounds access, which may cause further file system corruption. This commit adds a check for start_clu, if it is an invalid cluster, the file or directory will be treated as empty.
References
Impacted products
Vendor Product Version
Linux Linux Version: 1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003
Version: 1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003
Version: 1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/exfat/namei.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a0120d6463368378539ef928cf067d02372efb8c",
              "status": "affected",
              "version": "1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003",
              "versionType": "git"
            },
            {
              "lessThan": "3ddd1cb2b458ff6a193bc845f408dfff217db29e",
              "status": "affected",
              "version": "1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003",
              "versionType": "git"
            },
            {
              "lessThan": "184fa506e392eb78364d9283c961217ff2c0617b",
              "status": "affected",
              "version": "1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/exfat/namei.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.11",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.2",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nexfat: fix out-of-bounds access of directory entries\n\nIn the case of the directory size is greater than or equal to\nthe cluster size, if start_clu becomes an EOF cluster(an invalid\ncluster) due to file system corruption, then the directory entry\nwhere ei-\u003ehint_femp.eidx hint is outside the directory, resulting\nin an out-of-bounds access, which may cause further file system\ncorruption.\n\nThis commit adds a check for start_clu, if it is an invalid cluster,\nthe file or directory will be treated as empty."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T09:54:14.255Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a0120d6463368378539ef928cf067d02372efb8c"
        },
        {
          "url": "https://git.kernel.org/stable/c/3ddd1cb2b458ff6a193bc845f408dfff217db29e"
        },
        {
          "url": "https://git.kernel.org/stable/c/184fa506e392eb78364d9283c961217ff2c0617b"
        }
      ],
      "title": "exfat: fix out-of-bounds access of directory entries",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-53147",
    "datePublished": "2024-12-24T11:28:47.695Z",
    "dateReserved": "2024-11-19T17:17:24.998Z",
    "dateUpdated": "2025-05-04T09:54:14.255Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-53147\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-24T12:15:22.777\",\"lastModified\":\"2024-12-24T12:15:22.777\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nexfat: fix out-of-bounds access of directory entries\\n\\nIn the case of the directory size is greater than or equal to\\nthe cluster size, if start_clu becomes an EOF cluster(an invalid\\ncluster) due to file system corruption, then the directory entry\\nwhere ei-\u003ehint_femp.eidx hint is outside the directory, resulting\\nin an out-of-bounds access, which may cause further file system\\ncorruption.\\n\\nThis commit adds a check for start_clu, if it is an invalid cluster,\\nthe file or directory will be treated as empty.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: exfat: corrige el acceso fuera de los l\u00edmites de las entradas del directorio. En el caso de que el tama\u00f1o del directorio sea mayor o igual al tama\u00f1o del cl\u00faster, si start_clu se convierte en un cl\u00faster EOF (un cl\u00faster no v\u00e1lido cluster) debido a una corrupci\u00f3n del sistema de archivos, entonces la entrada del directorio donde ei-\u0026gt;hint_femp.eidx sugerencia est\u00e1 fuera del directorio, lo que resulta en un acceso fuera de los l\u00edmites, lo que puede causar una mayor corrupci\u00f3n del sistema de archivos. Este commit agrega una verificaci\u00f3n de start_clu; si es un cl\u00faster no v\u00e1lido, el archivo o directorio se tratar\u00e1 como vac\u00edo.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/184fa506e392eb78364d9283c961217ff2c0617b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3ddd1cb2b458ff6a193bc845f408dfff217db29e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a0120d6463368378539ef928cf067d02372efb8c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.