CVE-2024-41016

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-41016", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-12T12:17:45.612Z", "datePublished": "2024-07-29T06:37:02.530Z", "dateUpdated": "2026-10-15T00:47:16.242Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:34:42.104Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()\n\nxattr in ocfs2 maybe 'non-indexed', which saved with additional space\nrequested. It's better to check if the memory is out of bound before\nmemcmp, although this possibility mainly comes from crafted poisonous\nimages."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Reaching `ocfs2_xattr_find_entry()` requires a crafted OCFS2 image to be present locally (loop-mounted file or attached block device/USB stick) and then touched via `getxattr()`/`setxattr()` or an automatic security-label lookup; there is no remote protocol path into the ocfs2 xattr code.\nAC:L - The attacker authors the on-disk metadata, and `xe_name_offset` is an unvalidated `__le16`, so the read at `xs->base + name_offset` (up to 65535 bytes past a 512\u20134096 byte block buffer) fires deterministically on the first `getxattr()` with a matching type/name-length; no race, no memory-layout luck, and no non-default kernel config is involved, and for offsets inside the same page the \"out-of-bounds\" bytes are other blocks of the attacker's own image, making the `memcmp()` match reliably.\nPR:L - An unprivileged local user can supply the poisoned image (a file for loop-mount or removable media handled by udisks2/systemd automount) and then trigger the path with ordinary unprivileged `getxattr()`/`setxattr()` calls on the crafted file; no capability of the attacker's own is needed.\nUI:N - On the common desktop/kiosk/embedded deployment the attacker-supplied device is mounted automatically by the automount daemon, and the attacking process itself then issues the `getxattr()`/`setxattr()` that hits the unchecked `memcmp()` \u2014 no deliberate action by another user is required.\nS:U - The out-of-bounds read and the resulting out-of-bounds write stay inside the kernel's own memory and security authority; no VM, IOMMU, container, or sandbox boundary is crossed.\nC:H - Once the unchecked `memcmp()` matches out-of-bounds bytes, `ocfs2_xattr_ibody_get()`/`ocfs2_xattr_block_get()` `memcpy()` from `xs->base + xe_name_offset + name_len` for `xe_value_size` bytes (attacker-chosen, up to XATTR_SIZE_MAX) straight into the caller's userspace buffer, disclosing kernel memory beyond the buffer_head; the match/no-match result also forms a byte-granular oracle over ~64 KiB past the buffer.\nI:H - The same missing check on the setxattr path (`ocfs2_xattr_ibody_find()`/`ocfs2_xattr_block_find()`) lets a bogus `xe_name_offset` propagate into `ocfs2_xa_set()`, where `ocfs2_xa_reuse_entry()`/`ocfs2_xa_store_value()` `memset()`/`memcpy()` attacker-supplied value bytes at `base + name_offset`, and `ocfs2_xa_block_wipe_namevalue()` `memmove()`s with that offset \u2014 an out-of-bounds heap write with controlled content suitable for control-flow hijacking.\nA:H - The read (and the subsequent write/memmove) can land up to ~65790 bytes past a 512\u20134096 byte block buffer, readily touching unmapped or unrelated memory and producing a kernel oops/page fault (immediate KASAN slab-out-of-bounds), and corrupting neighbouring kernel data crashes the system; the trigger is repeatable on demand."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ocfs2/xattr.c"], "versions": [{"version": "cf1d6c763fbcb115263114302485ad17e7933d87", "lessThan": "e2b3d7a9d019d4d1a0da6c3ea64a1ff79c99c090", "status": "affected", "versionType": "git"}, {"version": "cf1d6c763fbcb115263114302485ad17e7933d87", "lessThan": "e8f9c4af7af7e9e4cd09c0251c7936593147419f", "status": "affected", "versionType": "git"}, {"version": "cf1d6c763fbcb115263114302485ad17e7933d87", "lessThan": "57a3d89831fcaa2cdbe024b47c7c36d5a56c3637", "status": "affected", "versionType": "git"}, {"version": "cf1d6c763fbcb115263114302485ad17e7933d87", "lessThan": "c031d286eceb82f72f8623b7f4abd2aa491bfb5e", "status": "affected", "versionType": "git"}, {"version": "cf1d6c763fbcb115263114302485ad17e7933d87", "lessThan": "cfb926051fab19b10d1e65976211f364aa820180", "status": "affected", "versionType": "git"}, {"version": "cf1d6c763fbcb115263114302485ad17e7933d87", "lessThan": "c726dea9d0c806d64c26fcef483b1fb9474d8c5e", "status": "affected", "versionType": "git"}, {"version": "cf1d6c763fbcb115263114302485ad17e7933d87", "lessThan": "e4ffea01adf3323c821b6f37e9577d2d400adbaa", "status": "affected", "versionType": "git"}, {"version": "cf1d6c763fbcb115263114302485ad17e7933d87", "lessThan": "af77c4fc1871847b528d58b7fdafb4aa1f6a9262", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ocfs2/xattr.c"], "versions": [{"version": "2.6.28", "status": "affected"}, {"version": "0", "lessThan": "2.6.28", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.323", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.285", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.227", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.168", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.112", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.53", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10.12", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.28", "versionEndExcluding": "4.19.323"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.28", "versionEndExcluding": "5.4.285"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.28", "versionEndExcluding": "5.10.227"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.28", "versionEndExcluding": "5.15.168"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.28", "versionEndExcluding": "6.1.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.28", "versionEndExcluding": "6.6.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.28", "versionEndExcluding": "6.10.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.28", "versionEndExcluding": "6.11"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e2b3d7a9d019d4d1a0da6c3ea64a1ff79c99c090"}, {"url": "https://git.kernel.org/stable/c/e8f9c4af7af7e9e4cd09c0251c7936593147419f"}, {"url": "https://git.kernel.org/stable/c/57a3d89831fcaa2cdbe024b47c7c36d5a56c3637"}, {"url": "https://git.kernel.org/stable/c/c031d286eceb82f72f8623b7f4abd2aa491bfb5e"}, {"url": "https://git.kernel.org/stable/c/cfb926051fab19b10d1e65976211f364aa820180"}, {"url": "https://git.kernel.org/stable/c/c726dea9d0c806d64c26fcef483b1fb9474d8c5e"}, {"url": "https://git.kernel.org/stable/c/e4ffea01adf3323c821b6f37e9577d2d400adbaa"}, {"url": "https://git.kernel.org/stable/c/af77c4fc1871847b528d58b7fdafb4aa1f6a9262"}], "title": "ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/af77c4fc1871847b528d58b7fdafb4aa1f6a9262", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T21:59:18.988Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-41016", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:24:43.120825Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:05.725Z"}}, {"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T00:47:16.242Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.1.1", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/af77c4fc1871847b528d58b7fdafb4aa1f6a9262", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T21:59:18.988Z"}}, {"affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.1.1", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T00:47:16.242Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-41016", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:24:43.120825Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:20.606Z"}}], "cna": {"title": "ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - Reaching `ocfs2_xattr_find_entry()` requires a crafted OCFS2 image to be present locally (loop-mounted file or attached block device/USB stick) and then touched via `getxattr()`/`setxattr()` or an automatic security-label lookup; there is no remote protocol path into the ocfs2 xattr code.\nAC:L - The attacker authors the on-disk metadata, and `xe_name_offset` is an unvalidated `__le16`, so the read at `xs->base + name_offset` (up to 65535 bytes past a 512\u20134096 byte block buffer) fires deterministically on the first `getxattr()` with a matching type/name-length; no race, no memory-layout luck, and no non-default kernel config is involved, and for offsets inside the same page the \"out-of-bounds\" bytes are other blocks of the attacker's own image, making the `memcmp()` match reliably.\nPR:L - An unprivileged local user can supply the poisoned image (a file for loop-mount or removable media handled by udisks2/systemd automount) and then trigger the path with ordinary unprivileged `getxattr()`/`setxattr()` calls on the crafted file; no capability of the attacker's own is needed.\nUI:N - On the common desktop/kiosk/embedded deployment the attacker-supplied device is mounted automatically by the automount daemon, and the attacking process itself then issues the `getxattr()`/`setxattr()` that hits the unchecked `memcmp()` \u2014 no deliberate action by another user is required.\nS:U - The out-of-bounds read and the resulting out-of-bounds write stay inside the kernel's own memory and security authority; no VM, IOMMU, container, or sandbox boundary is crossed.\nC:H - Once the unchecked `memcmp()` matches out-of-bounds bytes, `ocfs2_xattr_ibody_get()`/`ocfs2_xattr_block_get()` `memcpy()` from `xs->base + xe_name_offset + name_len` for `xe_value_size` bytes (attacker-chosen, up to XATTR_SIZE_MAX) straight into the caller's userspace buffer, disclosing kernel memory beyond the buffer_head; the match/no-match result also forms a byte-granular oracle over ~64 KiB past the buffer.\nI:H - The same missing check on the setxattr path (`ocfs2_xattr_ibody_find()`/`ocfs2_xattr_block_find()`) lets a bogus `xe_name_offset` propagate into `ocfs2_xa_set()`, where `ocfs2_xa_reuse_entry()`/`ocfs2_xa_store_value()` `memset()`/`memcpy()` attacker-supplied value bytes at `base + name_offset`, and `ocfs2_xa_block_wipe_namevalue()` `memmove()`s with that offset \u2014 an out-of-bounds heap write with controlled content suitable for control-flow hijacking.\nA:H - The read (and the subsequent write/memmove) can land up to ~65790 bytes past a 512\u20134096 byte block buffer, readily touching unmapped or unrelated memory and producing a kernel oops/page fault (immediate KASAN slab-out-of-bounds), and corrupting neighbouring kernel data crashes the system; the trigger is repeatable on demand."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "cf1d6c763fbcb115263114302485ad17e7933d87", "lessThan": "e2b3d7a9d019d4d1a0da6c3ea64a1ff79c99c090", "versionType": "git"}, {"status": "affected", "version": "cf1d6c763fbcb115263114302485ad17e7933d87", "lessThan": "e8f9c4af7af7e9e4cd09c0251c7936593147419f", "versionType": "git"}, {"status": "affected", "version": "cf1d6c763fbcb115263114302485ad17e7933d87", "lessThan": "57a3d89831fcaa2cdbe024b47c7c36d5a56c3637", "versionType": "git"}, {"status": "affected", "version": "cf1d6c763fbcb115263114302485ad17e7933d87", "lessThan": "c031d286eceb82f72f8623b7f4abd2aa491bfb5e", "versionType": "git"}, {"status": "affected", "version": "cf1d6c763fbcb115263114302485ad17e7933d87", "lessThan": "cfb926051fab19b10d1e65976211f364aa820180", "versionType": "git"}, {"status": "affected", "version": "cf1d6c763fbcb115263114302485ad17e7933d87", "lessThan": "c726dea9d0c806d64c26fcef483b1fb9474d8c5e", "versionType": "git"}, {"status": "affected", "version": "cf1d6c763fbcb115263114302485ad17e7933d87", "lessThan": "e4ffea01adf3323c821b6f37e9577d2d400adbaa", "versionType": "git"}, {"status": "affected", "version": "cf1d6c763fbcb115263114302485ad17e7933d87", "lessThan": "af77c4fc1871847b528d58b7fdafb4aa1f6a9262", "versionType": "git"}], "programFiles": ["fs/ocfs2/xattr.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.28"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.28", "versionType": "semver"}, {"status": "unaffected", "version": "4.19.323", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.285", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.227", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.168", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.112", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.53", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.10.12", "versionType": "semver", "lessThanOrEqual": "6.10.*"}, {"status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/ocfs2/xattr.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/e2b3d7a9d019d4d1a0da6c3ea64a1ff79c99c090"}, {"url": "https://git.kernel.org/stable/c/e8f9c4af7af7e9e4cd09c0251c7936593147419f"}, {"url": "https://git.kernel.org/stable/c/57a3d89831fcaa2cdbe024b47c7c36d5a56c3637"}, {"url": "https://git.kernel.org/stable/c/c031d286eceb82f72f8623b7f4abd2aa491bfb5e"}, {"url": "https://git.kernel.org/stable/c/cfb926051fab19b10d1e65976211f364aa820180"}, {"url": "https://git.kernel.org/stable/c/c726dea9d0c806d64c26fcef483b1fb9474d8c5e"}, {"url": "https://git.kernel.org/stable/c/e4ffea01adf3323c821b6f37e9577d2d400adbaa"}, {"url": "https://git.kernel.org/stable/c/af77c4fc1871847b528d58b7fdafb4aa1f6a9262"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()\n\nxattr in ocfs2 maybe 'non-indexed', which saved with additional space\nrequested. It's better to check if the memory is out of bound before\nmemcmp, although this possibility mainly comes from crafted poisonous\nimages."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.323", "versionStartIncluding": "2.6.28"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.285", "versionStartIncluding": "2.6.28"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.227", "versionStartIncluding": "2.6.28"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.168", "versionStartIncluding": "2.6.28"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.112", "versionStartIncluding": "2.6.28"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.53", "versionStartIncluding": "2.6.28"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10.12", "versionStartIncluding": "2.6.28"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.11", "versionStartIncluding": "2.6.28"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:34:42.104Z"}}}, "cveMetadata": {"cveId": "CVE-2024-41016", "state": "PUBLISHED", "dateUpdated": "2026-10-15T00:47:16.242Z", "dateReserved": "2024-07-12T12:17:45.612Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-07-29T06:37:02.530Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/ocfs2/xattr.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e2b3d7a9d019d4d1a0da6c3ea64a1ff79c99c090", "status": "affected", "version": "cf1d6c763fbcb115263114302485ad17e7933d87", "versionType": "git"}, {"lessThan": "e8f9c4af7af7e9e4cd09c0251c7936593147419f", "status": "affected", "version": "cf1d6c763fbcb115263114302485ad17e7933d87", "versionType": "git"}, {"lessThan": "57a3d89831fcaa2cdbe024b47c7c36d5a56c3637", "status": "affected", "version": "cf1d6c763fbcb115263114302485ad17e7933d87", "versionType": "git"}, {"lessThan": "c031d286eceb82f72f8623b7f4abd2aa491bfb5e", "status": "affected", "version": "cf1d6c763fbcb115263114302485ad17e7933d87", "versionType": "git"}, {"lessThan": "cfb926051fab19b10d1e65976211f364aa820180", "status": "affected", "version": "cf1d6c763fbcb115263114302485ad17e7933d87", "versionType": "git"}, {"lessThan": "c726dea9d0c806d64c26fcef483b1fb9474d8c5e", "status": "affected", "version": "cf1d6c763fbcb115263114302485ad17e7933d87", "versionType": "git"}, {"lessThan": "e4ffea01adf3323c821b6f37e9577d2d400adbaa", "status": "affected", "version": "cf1d6c763fbcb115263114302485ad17e7933d87", "versionType": "git"}, {"lessThan": "af77c4fc1871847b528d58b7fdafb4aa1f6a9262", "status": "affected", "version": "cf1d6c763fbcb115263114302485ad17e7933d87", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/ocfs2/xattr.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.28"}, {"lessThan": "2.6.28", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.323", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.285", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.227", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.168", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.112", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.53", "versionType": "semver"}, {"lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.12", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "V1.1.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "3BC77309-A76B-49EF-A846-844D824E3586", "versionEndExcluding": "4.19.323", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B5A89369-320F-47FC-8695-56F61F87E4C0", "versionEndExcluding": "5.4.285", "versionStartIncluding": "4.20", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "795A3EE6-0CAB-4409-A903-151C94ACECC0", "versionEndExcluding": "5.10.227", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4D51C05D-455B-4D8D-89E7-A58E140B864C", "versionEndExcluding": "5.15.168", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1C1227B7-CF55-4728-857F-966F83ACD8B5", "versionEndExcluding": "6.1.112", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "007075FA-C231-42B1-A525-B87CEA313C63", "versionEndExcluding": "6.6.53", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "42054751-2A4F-4982-ADE9-A8251AD9A7BC", "versionEndExcluding": "6.10.12", "versionStartIncluding": "6.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()\n\nxattr in ocfs2 maybe 'non-indexed', which saved with additional space\nrequested. It's better to check if the memory is out of bound before\nmemcmp, although this possibility mainly comes from crafted poisonous\nimages."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: ocfs2: verificaci\u00f3n de l\u00edmite estricto antes de memcmp en ocfs2_xattr_find_entry() xattr en ocfs2 puede ser 'non-indexed', lo que se guard\u00f3 con espacio adicional solicitado. Es mejor comprobar si la memoria est\u00e1 fuera de los l\u00edmites antes de memcmp, aunque esta posibilidad proviene principalmente de im\u00e1genes venenosas creadas."}], "id": "CVE-2024-41016", "lastModified": "2026-10-15T01:18:41.447", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-41016", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:24:43.120825Z", "version": "2.0.3"}}]}, "published": "2024-07-29T07:15:06.293", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/57a3d89831fcaa2cdbe024b47c7c36d5a56c3637"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/af77c4fc1871847b528d58b7fdafb4aa1f6a9262"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c031d286eceb82f72f8623b7f4abd2aa491bfb5e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c726dea9d0c806d64c26fcef483b1fb9474d8c5e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cfb926051fab19b10d1e65976211f364aa820180"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e2b3d7a9d019d4d1a0da6c3ea64a1ff79c99c090"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e4ffea01adf3323c821b6f37e9577d2d400adbaa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e8f9c4af7af7e9e4cd09c0251c7936593147419f"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/af77c4fc1871847b528d58b7fdafb4aa1f6a9262"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()", "id": "2300299", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2300299"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "(CWE-119|CWE-20)", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()\nxattr in ocfs2 maybe 'non-indexed', which saved with additional space\nrequested. It's better to check if the memory is out of bound before\nmemcmp, although this possibility mainly comes from crafted poisonous\nimages.", "A flaw was found in the ocfs2_xattr_find_entry() function in the Linux kernel's Oracle Cluster File System version 2 (OCFS2). This issue arose due to inadequate bounds checking before a memcmp operation, particularly when handling \"non-indexed\" extended attributes (xattrs) that might request additional space."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-41016", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-07-29T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-41016\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-41016\nhttps://lore.kernel.org/linux-cve-announce/2024072910-CVE-2024-41016-fcf9@gregkh/T"], "statement": "Red Hat Enterprise Linux is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux kernel used in its distributions.", "threat_severity": "Moderate"}

{"created": "2025-07-12T23:05:54.694231+00:00", "updated": "2025-07-12T23:05:54.694284+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}