CoreCVE
Back

HIGH

xfs: add bounds checking to xlog_recover_process_data

Published Jul 29, 2024

Description

There is a lack of verification of the space occupied by fixed members of xlog_op_header in the xlog_recover_process_data.

We can create a crafted image to trigger an out of bounds read by following these steps: 1) Mount an image of xfs, and do some file operations to leave records 2) Before umounting, copy the image for subsequent steps to simulate abnormal exit. Because umount will ensure that tail_blk and head_blk are the same, which will result in the inability to enter xlog_recover_process_data 3) Write a tool to parse and modify the copied image in step 2 4) Make the end of the xlog_op_header entries only 1 byte away from xlog_rec_header->h_size 5) xlog_rec_header->h_num_logops++ 6) Modify xlog_rec_header->h_crc

Fix: Add a check to make sure there is sufficient space to access fixed members of xlog_op_header.

Affected products

Remediation

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Weaknesses (1)

CWE-125

Out-of-bounds Read

References (9)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner Linux
Published Jul 29, 2024
Updated Aug 5, 2026
Reserved Jul 12, 2024
Link CVE-2024-41014
CISA Vulnrichment
Updated Sep 10, 2024
NVD
Status Modified
Modified Aug 4, 2026
Link CVE-2024-41014
Red Hat
Severity Moderate
Public date Jul 29, 2024
Links CVE-2024-41014 - Bugzilla