CVE-2024-44947

What it actually does

The vulnerability allows uninitialized kernel memory from beyond-EOF portions of FUSE pages to become visible to userspace processes via mmap() when init-on-alloc is disabled.

Why it matters to the business

Attackers on affected Linux systems may obtain fragments of sensitive kernel data, increasing risk of information disclosure in container and virtualized environments where FUSE is used.

How an attack unfolds

An attacker mounts a FUSE filesystem and triggers fuse_notify_store with a partial page write that leaves beyond-EOF bytes uninitialized; subsequent mmap access by a userspace process then exposes those bytes.

How to fix it

Update the Linux kernel to a version containing commit 49934861514d36d0995be8e81bb3312a499d8d9a or later; for Podman users, upgrade to version 1.6.0 or newer that incorporates the fix.

How to confirm the fix worked

Confirm the running kernel includes the referenced commit via git log or kernel version string; verify CONFIG_INIT_ON_ALLOC_DEFAULT_ON is enabled where possible and test mmap behavior on FUSE pages after the update.

Typical attack path

1. Mount a malicious or controlled FUSE filesystem
2. Issue operations that invoke fuse_notify_store on a partial page
3. Map the affected page via mmap in userspace
4. Read beyond-EOF regions to extract uninitialized kernel memory contents

How to detect it

Review kernel logs and audit records for unusual FUSE mount activity or notify_store operations; examine userspace processes performing mmap on FUSE-backed files for unexpected data patterns.

What your security team should do

• Prioritize kernel updates on all systems using FUSE, especially those without init-on-alloc enabled
• Audit FUSE usage in container runtimes and restrict untrusted FUSE mounts
• Enable CONFIG_INIT_ON_ALLOC_DEFAULT_ON or the equivalent boot parameter as a defense-in-depth measure
• Monitor for kernel updates in stable branches and schedule patching within standard change windows