CVE-2024-42257

HIGH

Linux Kernel 6.10 - Information Disclosure via ext4 Volume Name Handling

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: ext4: use memtostr_pad() for s_volume_name As with the other strings in struct ext4_super_block, s_volume_name is not NUL terminated. The other strings were marked in commit 072ebb3bffe6 ("ext4: add nonstring annotations to ext4.h"). Using strscpy() isn't the right replacement for strncpy(); it should use memtostr_pad() instead.

Scores

CVSS v3 7.8
EPSS 0.0020
EPSS Percentile 10.3%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

Status published
Products (8)
linux/Kernel 6.10.0 - 6.10.1linux
Linux/Linux < 6.10
Linux/Linux 6.10
Linux/Linux 6.10.1 - 6.10.*
Linux/Linux 6.11
Linux/Linux 744a56389f7398f286231e062c2e63f0de01bcc6 - 4378be89ddb7de88d984b67ecfd6191686c42817
Linux/Linux 744a56389f7398f286231e062c2e63f0de01bcc6 - be27cd64461c45a6088a91a04eba5cd44e1767ef
linux/linux_kernel 6.10 - 6.10.1
Published Aug 08, 2024
Tracked Since Feb 18, 2026