CVE-2024-44947 fuse: Initialize beyond-EOF page contents before setting uptodate

2024-09-0217:36:15

Linux

www.cve.org

linux kernel

cve-2024-44947

fuse vulnerability

EPSS

Percentile

14.0%

JSON

In the Linux kernel, the following vulnerability has been resolved:

fuse: Initialize beyond-EOF page contents before setting uptodate

fuse_notify_store(), unlike fuse_do_readpage(), does not enable page
zeroing (because it can be used to change partial page contents).

So fuse_notify_store() must be more careful to fully initialize page
contents (including parts of the page that are beyond end-of-file)
before marking the page uptodate.

The current code can leave beyond-EOF page contents uninitialized, which
makes these uninitialized page contents visible to userspace via mmap().

This is an information leak, but only affects systems which do not
enable init-on-alloc (via CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y or the
corresponding kernel command line parameter).

CNA Affected

[
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "unaffected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "fs/fuse/dev.c"
    ],
    "versions": [
      {
        "version": "a1d75f258230",
        "lessThan": "49934861514d",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "a1d75f258230",
        "lessThan": "33168db352c7",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "a1d75f258230",
        "lessThan": "4690e2171f65",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "a1d75f258230",
        "lessThan": "8c78303eafbf",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "a1d75f258230",
        "lessThan": "831433527773",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "a1d75f258230",
        "lessThan": "ac42e0f0eb66",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "a1d75f258230",
        "lessThan": "18a067240817",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "a1d75f258230",
        "lessThan": "3c0da3d163eb",
        "status": "affected",
        "versionType": "git"
      }
    ]
  },
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "affected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "fs/fuse/dev.c"
    ],
    "versions": [
      {
        "version": "2.6.36",
        "status": "affected"
      },
      {
        "version": "0",
        "lessThan": "2.6.36",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "4.19.321",
        "lessThanOrEqual": "4.19.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "5.4.283",
        "lessThanOrEqual": "5.4.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "5.10.225",
        "lessThanOrEqual": "5.10.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "5.15.166",
        "lessThanOrEqual": "5.15.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.1.107",
        "lessThanOrEqual": "6.1.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.6.48",
        "lessThanOrEqual": "6.6.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.10.7",
        "lessThanOrEqual": "6.10.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.11",
        "lessThanOrEqual": "*",
        "status": "unaffected",
        "versionType": "original_commit_for_fix"
      }
    ]
  }
]