{
  "threat_severity" : "Moderate",
  "public_date" : "2024-07-29T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: xfs: add bounds checking to xlog_recover_process_data",
    "id" : "2300297",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2300297"
  },
  "cvss3" : {
    "cvss3_base_score" : "6.1",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-125",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nxfs: add bounds checking to xlog_recover_process_data\nThere is a lack of verification of the space occupied by fixed members\nof xlog_op_header in the xlog_recover_process_data.\nWe can create a crafted image to trigger an out of bounds read by\nfollowing these steps:\n1) Mount an image of xfs, and do some file operations to leave records\n2) Before umounting, copy the image for subsequent steps to simulate\nabnormal exit. Because umount will ensure that tail_blk and\nhead_blk are the same, which will result in the inability to enter\nxlog_recover_process_data\n3) Write a tool to parse and modify the copied image in step 2\n4) Make the end of the xlog_op_header entries only 1 byte away from\nxlog_rec_header->h_size\n5) xlog_rec_header->h_num_logops++\n6) Modify xlog_rec_header->h_crc\nFix:\nAdd a check to make sure there is sufficient space to access fixed members\nof xlog_op_header.", "A vulnerability has been identified within the Linux kernel's xlog_recover_process_data() function. Specifically, the function lacks proper bounds checking on the space allocated for the fixed members of the xlog_op_header structure during log record processing. This omission can lead to an out-of-bounds memory access.\nThe potential impact of this flaw includes unpredictable system behavior and kernel-level crashes. Successful exploitation could disrupt system availability and potentially be leveraged for further malicious activities, depending on the context and any subsequent vulnerabilities exposed by the undefined behavior." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2024-09-24T00:00:00Z",
    "advisory" : "RHSA-2024:7001",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8::nfv",
    "package" : "kernel-rt-0:4.18.0-553.22.1.rt7.363.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2024-09-24T00:00:00Z",
    "advisory" : "RHSA-2024:7000",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8",
    "package" : "kernel-0:4.18.0-553.22.1.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
    "release_date" : "2024-09-04T00:00:00Z",
    "advisory" : "RHSA-2024:6297",
    "cpe" : "cpe:/o:redhat:rhel_aus:8.6",
    "package" : "kernel-0:4.18.0-372.121.1.el8_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
    "release_date" : "2024-09-04T00:00:00Z",
    "advisory" : "RHSA-2024:6297",
    "cpe" : "cpe:/o:redhat:rhel_tus:8.6",
    "package" : "kernel-0:4.18.0-372.121.1.el8_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
    "release_date" : "2024-09-04T00:00:00Z",
    "advisory" : "RHSA-2024:6297",
    "cpe" : "cpe:/o:redhat:rhel_e4s:8.6",
    "package" : "kernel-0:4.18.0-372.121.1.el8_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Extended Update Support",
    "release_date" : "2024-11-26T00:00:00Z",
    "advisory" : "RHSA-2024:10262",
    "cpe" : "cpe:/o:redhat:rhel_eus:8.8",
    "package" : "kernel-0:4.18.0-477.81.1.el8_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2024-10-30T00:00:00Z",
    "advisory" : "RHSA-2024:8617",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-427.42.1.el9_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2024-10-30T00:00:00Z",
    "advisory" : "RHSA-2024:8617",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-427.42.1.el9_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Extended Update Support",
    "release_date" : "2024-12-04T00:00:00Z",
    "advisory" : "RHSA-2024:10772",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.2",
    "package" : "kernel-0:5.14.0-284.95.1.el9_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Extended Update Support",
    "release_date" : "2024-12-04T00:00:00Z",
    "advisory" : "RHSA-2024:10773",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.2::nfv",
    "package" : "kernel-rt-0:5.14.0-284.95.1.rt14.380.el9_2"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2024-41014\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-41014\nhttps://lore.kernel.org/linux-cve-announce/2024072910-CVE-2024-41014-9186@gregkh/T" ],
  "name" : "CVE-2024-41014",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}