CVE-2024-41013

What it actually does

Out-of-bounds read in XFS directory data block parsing caused by insufficient length and alignment checks on xfs_dir2_data_unused and xfs_dir2_data_entry structures, allowing traversal past valid memory regions in crafted images.

Why it matters to the business

Linux systems using the XFS filesystem face elevated risk of crashes, denial of service, or limited information disclosure when processing untrusted directory structures, with broad impact across servers, embedded devices, and Android kernels given the kernel's ecosystem prevalence.

How an attack unfolds

An attacker creates a malicious XFS filesystem image where the final directory entry is an xfs_dir2_data_unused structure whose length field is decremented by one byte, leaving a one-byte gap that is misinterpreted on subsequent traversals; this triggers an out-of-bounds read when accessing fixed structure members. The image is then presented to the victim kernel via mount, file copy, or other XFS operations. Named threat actors have referenced this class of Linux kernel out-of-bounds read and Android kernel remote code execution issues, though public exploitation maturity remains none.

How to fix it

Upgrade the Linux kernel to a version containing commit 98f7e32f20d28ec452afb208f9cffc08448a2652 (mainline) or b0932e4f9da85349d1c8f2a77d2a7a7163b8511d (stable). Rebuild and reboot affected systems; for distributions, apply the corresponding vendor kernel package that backports these fixes.

How to confirm the fix worked

Confirm the running kernel contains one of the listed fixed commits via uname or kernel build logs; attempt to mount a test image containing a crafted one-byte gap directory entry and verify no out-of-bounds access occurs; review kernel source for the added remaining-bytes and alignment checks before xfs_dir2_data_unused and xfs_dir2_data_entry access.

Typical attack path

1. Craft a malicious XFS image with manipulated final directory entry length
2. Present the image to the target system through mount, filesystem image import, or untrusted storage
3. Trigger directory traversal or data block walk in the XFS code path
4. Cause the kernel to interpret the crafted gap as a valid unused or directory entry
5. Read beyond allocated memory region

How to detect it

Review kernel logs for XFS-related oops, warnings, or panics mentioning directory data block walks; correlate with unusual mount operations on external or untrusted storage; examine audit logs for XFS filesystem activity originating from unexpected sources.

What your security team should do

• Prioritize kernel updates on all XFS-using systems within standard patch windows given low EPSS and absence from KEV
• Monitor upstream stable branches for additional backports
• Restrict mounting of untrusted XFS images via policy or container isolation until patches are deployed