CVE-2024-42257
HIGHLinux Kernel 6.10 - Information Disclosure via ext4 Volume Name Handling
Title source: llmDescription
In the Linux kernel, the following vulnerability has been resolved: ext4: use memtostr_pad() for s_volume_name As with the other strings in struct ext4_super_block, s_volume_name is not NUL terminated. The other strings were marked in commit 072ebb3bffe6 ("ext4: add nonstring annotations to ext4.h"). Using strscpy() isn't the right replacement for strncpy(); it should use memtostr_pad() instead.
References (2)
Core 2
Scores
CVSS v3
7.8
EPSS
0.0020
EPSS Percentile
10.3%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
Status
published
Products (8)
linux/Kernel
6.10.0 - 6.10.1linux
Linux/Linux
< 6.10
Linux/Linux
6.10
Linux/Linux
6.10.1 - 6.10.*
Linux/Linux
6.11
Linux/Linux
744a56389f7398f286231e062c2e63f0de01bcc6 - 4378be89ddb7de88d984b67ecfd6191686c42817
Linux/Linux
744a56389f7398f286231e062c2e63f0de01bcc6 - be27cd64461c45a6088a91a04eba5cd44e1767ef
linux/linux_kernel
6.10 - 6.10.1
Published
Aug 08, 2024
Tracked Since
Feb 18, 2026