CVE-2024-41014

What it actually does

Out-of-bounds read in xlog_recover_process_data due to missing bounds verification on fixed members of xlog_op_header when processing a crafted XFS log image.

Why it matters to the business

Systems using the XFS filesystem may experience kernel crashes, memory disclosure, or denial of service when mounting malicious images, resulting in unplanned downtime and potential data exposure on servers and embedded devices.

How an attack unfolds

An attacker prepares a malicious XFS filesystem image by modifying log records so that xlog_op_header entries end only one byte before h_size, increments h_num_logops, and adjusts the CRC; when the image is mounted on a vulnerable kernel the recovery code in xlog_recover_process_data performs an out-of-bounds read.

How to fix it

Upgrade the Linux kernel to a version containing commit 98f7e32f20d28ec452afb208f9cffc08448a2652 (mainline) or d1e3efe783365db59da88f08a2e0bfe1cc95b143 (stable trees); rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the running kernel contains the listed commit hashes, then mount a test image that previously triggered the out-of-bounds condition and verify no crash or unexpected memory access occurs.

Typical attack path

1. Create or obtain an XFS image and perform normal file operations to populate the log
2. Copy the image before clean unmount to preserve an inconsistent log state
3. Parse and edit the image to position xlog_op_header entries one byte from h_size
4. Increment h_num_logops and recompute h_crc
5. Mount the crafted image on a vulnerable kernel to trigger xlog_recover_process_data

How to detect it

Review kernel logs for XFS recovery errors or oops messages referencing xlog_recover_process_data; inspect auditd or system-call logs for unexpected mount operations on XFS volumes from untrusted sources.

What your security team should do

• Apply the referenced kernel commits immediately on all systems that mount XFS volumes
• Prioritize patching production servers and Android devices that use XFS or ext4-derived filesystems
• Monitor kernel update channels for backports into distribution kernels
• Restrict mounting of untrusted XFS images until patches are deployed