CVE-2024-53147
Severity CVSS v4.0:
Pending analysis
Type:
CWE-125
Out-of-bounds Read
Publication date:
24/12/2024
Last modified:
01/10/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
exfat: fix out-of-bounds access of directory entries<br />
<br />
In the case of the directory size is greater than or equal to<br />
the cluster size, if start_clu becomes an EOF cluster(an invalid<br />
cluster) due to file system corruption, then the directory entry<br />
where ei->hint_femp.eidx hint is outside the directory, resulting<br />
in an out-of-bounds access, which may cause further file system<br />
corruption.<br />
<br />
This commit adds a check for start_clu, if it is an invalid cluster,<br />
the file or directory will be treated as empty.
Impact
Base Score 3.x
7.10
Severity 3.x
HIGH
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.7 (including) | 6.11.11 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.12 (including) | 6.12.2 (excluding) |
To consult the complete list of CPE names with products and versions, see this page