CVE-2024-27407

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-27407", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-25T13:47:42.681Z", "datePublished": "2024-05-17T11:40:32.129Z", "dateUpdated": "2026-08-05T11:29:37.826Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:29:37.826Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Fixed overflow check in mi_enum_attr()"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The attack payload is a crafted NTFS volume parsed by the in-kernel ntfs3 driver at mount/inode-load time and exercised via ordinary read/write syscalls on the mounted volume; this is a local block-device or loop-mounted-image operation with no network protocol handler in the path.\nAC:L - The attacker fully controls the on-disk bytes and simply sets a resident attribute's res.data_size to a value near 0xFFFFFFFF so that t16 + data_size wraps the u32 addition; the check is bypassed deterministically on every parse, with no race, timing, or memory-layout dependency.\nPR:N - The attacker needs no account or privilege on the target \u2014 the entire payload is the crafted filesystem image (USB stick, disk image, or media handed to an automounter such as udisks2 on desktops, kiosks, Android and automotive head units), matching how other ntfs3 image-parsing flaws in this subsystem are scored.\nUI:R - Someone on the target must mount the malicious volume, or insert the media into a system running an automounter; ntfs3 is FS_REQUIRES_DEV without FS_USERNS_MOUNT, so it cannot be mounted from an unprivileged user namespace.\nS:U - The out-of-bounds accesses occur in kernel memory within the same security authority as the mounting kernel; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - attr_data_read_resident() memcpy's a full page from mrec + data_off + vbo, with vbo chosen by the attacker anywhere in [0, ~4 GiB) past a 1 KiB kmalloc'd MFT record, delivering that kernel heap and direct-map content into a page the attacker reads \u2014 a controlled-offset arbitrary kernel memory read, not a bounded leak.\nI:H - On a read-write mount, attr_data_write_resident() performs memcpy(data + vbo, kaddr, use), writing a page of fully attacker-controlled bytes at an attacker-chosen offset up to ~4 GiB beyond the 1 KiB slab object \u2014 a write-what-where primitive suitable for cred/page-table corruption and control-flow hijack.\nA:H - Reading or writing gigabytes past a 1 KiB slab object reliably touches unmapped or guarded memory, producing an immediate oops/panic (or a KASAN slab-out-of-bounds BUG), and the ~4 GiB kvmalloc plus memcpy in ntfs_load_attr_list() crashes the mounting task outright."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ntfs3/record.c"], "versions": [{"version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e", "lessThan": "e99faa97359654b6e4e769246c72cf50a57e05b2", "status": "affected", "versionType": "git"}, {"version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e", "lessThan": "8c77398c72618101d66480b94b34fe9087ee3d08", "status": "affected", "versionType": "git"}, {"version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e", "lessThan": "1c0a95d99b1b2b5d842e5abc7ef7eed1193b60d7", "status": "affected", "versionType": "git"}, {"version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e", "lessThan": "652cfeb43d6b9aba5c7c4902bed7a7340df131fb", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ntfs3/record.c"], "versions": [{"version": "5.15", "status": "affected"}, {"version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.120", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.19", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.7", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.1.120"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.6.19"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.7.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.8"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e99faa97359654b6e4e769246c72cf50a57e05b2"}, {"url": "https://git.kernel.org/stable/c/8c77398c72618101d66480b94b34fe9087ee3d08"}, {"url": "https://git.kernel.org/stable/c/1c0a95d99b1b2b5d842e5abc7ef7eed1193b60d7"}, {"url": "https://git.kernel.org/stable/c/652cfeb43d6b9aba5c7c4902bed7a7340df131fb"}], "title": "fs/ntfs3: Fixed overflow check in mi_enum_attr()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-120", "lang": "en", "description": "CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"}]}], "affected": [{"vendor": "linux", "product": "linux_kernel", "cpes": ["cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "1da177e4c3f4", "status": "affected"}]}, {"vendor": "linux", "product": "linux_kernel", "cpes": ["cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "6.6.19", "status": "unaffected"}]}, {"vendor": "linux", "product": "linux_kernel", "cpes": ["cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "6.7.7", "status": "unaffected"}]}, {"vendor": "linux", "product": "linux_kernel", "cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "6.8", "status": "unaffected"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-05-17T15:31:07.732182Z", "id": "CVE-2024-27407", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-28T16:37:08.605Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/8c77398c72618101d66480b94b34fe9087ee3d08", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1c0a95d99b1b2b5d842e5abc7ef7eed1193b60d7", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/652cfeb43d6b9aba5c7c4902bed7a7340df131fb", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:37:04.117Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/8c77398c72618101d66480b94b34fe9087ee3d08", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1c0a95d99b1b2b5d842e5abc7ef7eed1193b60d7", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/652cfeb43d6b9aba5c7c4902bed7a7340df131fb", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:37:04.117Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-27407", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-17T15:31:07.732182Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "affected", "version": "1da177e4c3f4"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "unaffected", "version": "6.6.19"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "unaffected", "version": "6.7.7"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "unaffected", "version": "6.8"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-120", "description": "CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-17T15:30:27.169Z"}}], "cna": {"title": "fs/ntfs3: Fixed overflow check in mi_enum_attr()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The attack payload is a crafted NTFS volume parsed by the in-kernel ntfs3 driver at mount/inode-load time and exercised via ordinary read/write syscalls on the mounted volume; this is a local block-device or loop-mounted-image operation with no network protocol handler in the path.\nAC:L - The attacker fully controls the on-disk bytes and simply sets a resident attribute's res.data_size to a value near 0xFFFFFFFF so that t16 + data_size wraps the u32 addition; the check is bypassed deterministically on every parse, with no race, timing, or memory-layout dependency.\nPR:N - The attacker needs no account or privilege on the target \u2014 the entire payload is the crafted filesystem image (USB stick, disk image, or media handed to an automounter such as udisks2 on desktops, kiosks, Android and automotive head units), matching how other ntfs3 image-parsing flaws in this subsystem are scored.\nUI:R - Someone on the target must mount the malicious volume, or insert the media into a system running an automounter; ntfs3 is FS_REQUIRES_DEV without FS_USERNS_MOUNT, so it cannot be mounted from an unprivileged user namespace.\nS:U - The out-of-bounds accesses occur in kernel memory within the same security authority as the mounting kernel; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - attr_data_read_resident() memcpy's a full page from mrec + data_off + vbo, with vbo chosen by the attacker anywhere in [0, ~4 GiB) past a 1 KiB kmalloc'd MFT record, delivering that kernel heap and direct-map content into a page the attacker reads \u2014 a controlled-offset arbitrary kernel memory read, not a bounded leak.\nI:H - On a read-write mount, attr_data_write_resident() performs memcpy(data + vbo, kaddr, use), writing a page of fully attacker-controlled bytes at an attacker-chosen offset up to ~4 GiB beyond the 1 KiB slab object \u2014 a write-what-where primitive suitable for cred/page-table corruption and control-flow hijack.\nA:H - Reading or writing gigabytes past a 1 KiB slab object reliably touches unmapped or guarded memory, producing an immediate oops/panic (or a KASAN slab-out-of-bounds BUG), and the ~4 GiB kvmalloc plus memcpy in ntfs_load_attr_list() crashes the mounting task outright."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e", "lessThan": "e99faa97359654b6e4e769246c72cf50a57e05b2", "versionType": "git"}, {"status": "affected", "version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e", "lessThan": "8c77398c72618101d66480b94b34fe9087ee3d08", "versionType": "git"}, {"status": "affected", "version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e", "lessThan": "1c0a95d99b1b2b5d842e5abc7ef7eed1193b60d7", "versionType": "git"}, {"status": "affected", "version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e", "lessThan": "652cfeb43d6b9aba5c7c4902bed7a7340df131fb", "versionType": "git"}], "programFiles": ["fs/ntfs3/record.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.15"}, {"status": "unaffected", "version": "0", "lessThan": "5.15", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.120", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.19", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7.7", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/ntfs3/record.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/e99faa97359654b6e4e769246c72cf50a57e05b2"}, {"url": "https://git.kernel.org/stable/c/8c77398c72618101d66480b94b34fe9087ee3d08"}, {"url": "https://git.kernel.org/stable/c/1c0a95d99b1b2b5d842e5abc7ef7eed1193b60d7"}, {"url": "https://git.kernel.org/stable/c/652cfeb43d6b9aba5c7c4902bed7a7340df131fb"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Fixed overflow check in mi_enum_attr()"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.120", "versionStartIncluding": "5.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.19", "versionStartIncluding": "5.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.7.7", "versionStartIncluding": "5.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8", "versionStartIncluding": "5.15"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:29:37.826Z"}}}, "cveMetadata": {"cveId": "CVE-2024-27407", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:29:37.826Z", "dateReserved": "2024-02-25T13:47:42.681Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-17T11:40:32.129Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/ntfs3/record.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e99faa97359654b6e4e769246c72cf50a57e05b2", "status": "affected", "version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e", "versionType": "git"}, {"lessThan": "8c77398c72618101d66480b94b34fe9087ee3d08", "status": "affected", "version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e", "versionType": "git"}, {"lessThan": "1c0a95d99b1b2b5d842e5abc7ef7eed1193b60d7", "status": "affected", "version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e", "versionType": "git"}, {"lessThan": "652cfeb43d6b9aba5c7c4902bed7a7340df131fb", "status": "affected", "version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/ntfs3/record.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.15"}, {"lessThan": "5.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.120", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.19", "versionType": "semver"}, {"lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"cpes": ["cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [{"status": "affected", "version": "1da177e4c3f4"}]}, {"cpes": ["cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [{"status": "unaffected", "version": "6.6.19"}]}, {"cpes": ["cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [{"status": "unaffected", "version": "6.7.7"}]}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [{"status": "unaffected", "version": "6.8"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A888486F-7C4F-488B-B3A1-538E0D5D339C", "versionEndExcluding": "6.1.120", "versionStartIncluding": "5.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8D82004C-B2AE-4048-9344-32EFF65953B0", "versionEndExcluding": "6.6.19", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "575EE16B-67F2-4B5B-B5F8-1877715C898B", "versionEndExcluding": "6.7.7", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*", "matchCriteriaId": "B9F4EA73-0894-400F-A490-3A397AB7A517", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*", "matchCriteriaId": "056BD938-0A27-4569-B391-30578B309EE3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*", "matchCriteriaId": "F02056A5-B362-4370-9FF8-6F0BD384D520", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Fixed overflow check in mi_enum_attr()"}, {"lang": "es", "value": " En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: fs/ntfs3: Se corrigi\u00f3 la verificaci\u00f3n de desbordamiento en mi_enum_attr()"}], "id": "CVE-2024-27407", "lastModified": "2026-08-04T11:17:46.763", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-27407", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-05-17T15:31:07.732182Z", "version": "2.0.3"}}]}, "published": "2024-05-17T12:15:11.000", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1c0a95d99b1b2b5d842e5abc7ef7eed1193b60d7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/652cfeb43d6b9aba5c7c4902bed7a7340df131fb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8c77398c72618101d66480b94b34fe9087ee3d08"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e99faa97359654b6e4e769246c72cf50a57e05b2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1c0a95d99b1b2b5d842e5abc7ef7eed1193b60d7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/652cfeb43d6b9aba5c7c4902bed7a7340df131fb"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8c77398c72618101d66480b94b34fe9087ee3d08"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-120"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: fs/ntfs3: Fixed overflow check in mi_enum_attr()", "id": "2281119", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2281119"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nfs/ntfs3: Fixed overflow check in mi_enum_attr()"], "name": "CVE-2024-27407", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-17T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-27407\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-27407\nhttps://lore.kernel.org/linux-cve-announce/2024051739-CVE-2024-27407-976d@gregkh/T"], "threat_severity": "Moderate"}

{}