PT-2024-33919 · Linux+6 · Linux Kernel+6
Roi Martin
·
Published
2024-10-28
·
Updated
2025-10-03
·
CVE-2024-50087
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions:
Linux kernel (affected versions not specified)
Description:
The issue arises in the Linux kernel's btrfs component, specifically within the
read alloc one name() function. This function does not properly initialize the name field of the fscrypt str struct when kmalloc fails to allocate the necessary buffer. As a result, it is not guaranteed that fscrypt str.name is initialized when it is freed, leading to potential issues. The problem is a follow-up to a patch that addressed the remaining instances of a bug introduced by a specific commit that changed the use of struct qstr instead of name and namelen pairs.Recommendations:
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Use of Uninitialized Resource
Access of Uninitialized Pointer
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu