CVE-2024-41059

What it actually does

Uninitialized kernel memory allocated for an xattr name buffer in hfsplus_listxattr is passed to sized_strscpy without zeroing, allowing uninitialized values to be read during copy_name and subsequent listxattr operations.

Why it matters to the business

Systems mounting HFS+ volumes may experience kernel instability, information disclosure from kernel memory, or local denial of service; urgency is low given the eight-month-old issue, absence from KEV, and flat low EPSS.

How an attack unfolds

An attacker with local access creates or accesses an HFS+ filesystem, invokes listxattr on a file with extended attributes, and triggers the uninitialized buffer path in copy_name; the listed threat actors have not been observed exploiting this specific flaw.

How to fix it

Update the Linux kernel to commit 72805debec8f7aa342da194fe0ed7bc8febea335 or later; rebuild and reboot with the patched kernel; disable HFS+ support if the filesystem is not required.

How to confirm the fix worked

Confirm the running kernel contains commit 72805debec8f7aa342da194fe0ed7bc8febea335; recompile a test kernel with KMSAN enabled and verify the uninit-value report no longer triggers on listxattr of HFS+ files; monitor for the fixed allocation pattern that zeros strbuf.

Typical attack path

1. Mount or access an HFS+ volume containing extended attributes
2. Call listxattr (or equivalent) on a file or directory
3. Trigger kmalloc allocation inside hfsplus_listxattr without subsequent memset
4. Reach copy_name which reads uninitialized bytes via sized_strscpy
5. Observe kernel oops, information leak, or undefined behavior

How to detect it

Search kernel logs and audit trails for KMSAN or BUG reports mentioning sized_strscpy, copy_name, or hfsplus/xattr.c; examine crash dumps containing slab allocations from hfsplus_listxattr; correlate with processes calling listxattr on HFS+ mounts.

What your security team should do

• Prioritize patching production systems that still mount HFS+ volumes within normal change windows
• Audit kernel configurations to ensure HFS+ is compiled as a module and blacklisted where unnecessary
• Add the fixed commit hash to internal kernel build pipelines and SBOMs
• Review logging for any prior kernel warnings or KMSAN reports referencing hfsplus/xattr.c