CVE-2024-43845

What it actually does

Uninitialized memory access in udf_rename() when passing incomplete on-stack diriter.fi structure (only containing struct fileIdentDesc without impUse or name fields) to udf_update_tag() for checksum computation, reading beyond the structure into random stack contents.

Why it matters to the business

Low operational risk due to the issue being harmless as checksum is recomputed correctly later by udf_fiiter_write_fi(); affects UDF filesystem users during directory moves with 404 downstream dependents indicating moderate ecosystem reach but no urgent disruption.

How an attack unfolds

An attacker triggers udf_rename() on a moved directory containing a '..' entry, causing the kernel to perform a bogus checksum on uninitialized stack memory; reported via syzbot with no known threat actors or real-world exploitation.

How to fix it

Apply the kernel patch that removes the bogus udf_update_tag() call before udf_fiiter_write_fi(); upgrade affected Linux distributions to versions containing the fix for CVE-2024-43845.

How to confirm the fix worked

Confirm kernel source contains removal of premature udf_update_tag() in udf_rename(); test by performing directory renames on UDF volumes and verify no memory sanitizer reports.

Typical attack path

1. Mount or access a UDF filesystem volume
2. Perform a directory rename operation that moves a subdirectory
3. Invoke udf_rename() which calls udf_update_tag() on incomplete structure

How to detect it

Search kernel logs and audit trails for UDF rename operations around the time of any memory-related warnings; no specific post-exploitation artifacts expected due to harmless nature.

What your security team should do

• Prioritize kernel updates on systems using UDF filesystems
• Monitor for syzbot or similar fuzzer reports on filesystem code
• Review UDF usage in embedded or storage environments