{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-41018","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-07-12T12:17:45.612Z","datePublished":"2024-07-29T06:37:04.372Z","dateUpdated":"2026-08-05T11:34:44.241Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:34:44.241Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Add a check for attr_names and oatbl\n\nAdded out-of-bound checking for *ane (ATTR_NAME_ENTRY)."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable parser is reached only through the local mount path (`mount()` → `ntfs_fill_super()` → `ntfs_loadlog_and_replay()` → `log_replay()`), requiring the attacker to present a crafted NTFS block device or image to the local system. No network or remote-peer input reaches this code.\nAC:L - Every value driving the overflow (`rst->attr_names_len`, `open_attr_len`, and each `ATTR_NAME_ENTRY.off`/`name_bytes`) comes verbatim from the attacker-authored `$LogFile`, so the out-of-bounds walk and the controlled-offset write trigger deterministically on the first mount with no race and no reliance on conditions outside the attacker's control.\nPR:L - On the realistic target (shared workstation, kiosk, automotive/embedded head unit) an unprivileged local user with a session can get a crafted NTFS volume mounted through udisks2/polkit removable-media automount or an fstab/mount helper, so basic local user access suffices rather than real root.\nUI:N - In the automount scenario the attacker triggers the mount themselves by attaching the media; no separate victim has to open a file, run a command, or take any action for `log_replay()` to parse the malicious log.\nS:U - The corruption is confined to kernel heap memory within the same kernel security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The unbounded `while (ane->off)` walk reads far past the end of the `attr_names` slab allocation, and the resulting heap corruption of adjacent slab objects (including planting a kernel heap pointer into neighbouring structures) is leverageable into broad kernel memory disclosure.\nI:H - `Add2Ptr(oatbl, le16_to_cpu(ane->off))` gives an attacker-chosen offset of up to 65535 bytes beyond a small `kmemdup()` allocation, at which the code writes an 8-byte kernel pointer plus two attacker-influenced bytes — a controlled out-of-bounds heap write suitable for overwriting adjacent objects and hijacking control flow.\nA:H - Even without full exploitation, the out-of-bounds reads and writes reliably corrupt slab memory or hit unmapped pages during mount, producing an oops or panic."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ntfs3/fslog.c"],"versions":[{"version":"e0b64e4ad2eb013fd3299e34e7fe5e19f321e140","lessThan":"f3124d51e4e7b56a732419d8dc270e807252334f","status":"affected","versionType":"git"},{"version":"865e7a7700d930d34895a70f8af2eb4e778a5b0e","lessThan":"c114d2b88f8b226d4b2acf5a1ba0412cde6c31dd","status":"affected","versionType":"git"},{"version":"865e7a7700d930d34895a70f8af2eb4e778a5b0e","lessThan":"9b71f820f7168f1eab8378c80c7ea8a022a475bc","status":"affected","versionType":"git"},{"version":"865e7a7700d930d34895a70f8af2eb4e778a5b0e","lessThan":"702d4930eb06dcfda85a2fa67e8a1a27bfa2a845","status":"affected","versionType":"git"},{"version":"653687cca0fdbf426c078b46c377c57bee49e837","status":"affected","versionType":"git"},{"version":"6.6.19","lessThan":"6.6.43","status":"affected","versionType":"semver"},{"version":"6.7.7","lessThan":"6.8","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ntfs3/fslog.c"],"versions":[{"version":"6.8","status":"affected"},{"version":"0","lessThan":"6.8","status":"unaffected","versionType":"semver"},{"version":"6.6.43","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.9.12","lessThanOrEqual":"6.9.*","status":"unaffected","versionType":"semver"},{"version":"6.10.2","lessThanOrEqual":"6.10.*","status":"unaffected","versionType":"semver"},{"version":"6.11","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.19","versionEndExcluding":"6.6.43"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.8","versionEndExcluding":"6.9.12"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.8","versionEndExcluding":"6.10.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.8","versionEndExcluding":"6.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7.7"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/f3124d51e4e7b56a732419d8dc270e807252334f"},{"url":"https://git.kernel.org/stable/c/c114d2b88f8b226d4b2acf5a1ba0412cde6c31dd"},{"url":"https://git.kernel.org/stable/c/9b71f820f7168f1eab8378c80c7ea8a022a475bc"},{"url":"https://git.kernel.org/stable/c/702d4930eb06dcfda85a2fa67e8a1a27bfa2a845"}],"title":"fs/ntfs3: Add a check for attr_names and oatbl","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T04:39:56.071Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/f3124d51e4e7b56a732419d8dc270e807252334f","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/c114d2b88f8b226d4b2acf5a1ba0412cde6c31dd","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/9b71f820f7168f1eab8378c80c7ea8a022a475bc","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/702d4930eb06dcfda85a2fa67e8a1a27bfa2a845","tags":["x_transferred"]}]},{"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-41018","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-09-10T16:24:35.520516Z"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-09-11T17:34:05.489Z"}}]}}