CVE-2024-47670

What it actually does

Missing bounds check in ocfs2_xattr_find_entry() allows out-of-bounds memory access when scanning xattr entries on a crafted OCFS2 filesystem image.

Why it matters to the business

Linux systems using the OCFS2 clustered filesystem face risk of crashes, data corruption, or potential code execution when mounting untrusted images; low immediate operational impact given no known exploitation campaigns or ransomware use.

How an attack unfolds

An attacker supplies a malicious OCFS2 filesystem image containing malformed xattr structures; when the kernel scans for matching entries without the added bounds check, it reads or writes beyond the valid memory region, enabling local privilege escalation or denial of service.

How to fix it

Upgrade the Linux kernel to a version containing commit b49a786beb11ff740cb9e0c20b999c2a0e1729c2 or later stable releases; for container environments update moby/docker to 20.10.9+incompatible or newer when rebuilding images that include kernel modules.

How to confirm the fix worked

Verify the running kernel contains the fix commit; test by attempting to mount a crafted OCFS2 image that previously triggered the out-of-bounds access and confirm no crash or memory violation occurs.

Typical attack path

1. Obtain or create a crafted OCFS2 filesystem image with oversized or malformed xattr entries
2. Mount the image on a vulnerable Linux kernel (locally or via container/VM)
3. Trigger ocfs2_xattr_find_entry() during xattr lookup or listing operations
4. Achieve out-of-bounds read/write leading to crash or arbitrary code execution

How to detect it

Review kernel logs for oops/panic messages referencing ocfs2_xattr_find_entry or out-of-bounds accesses during filesystem mount or xattr operations; inspect audit logs for unexpected OCFS2 mount attempts from untrusted sources.

What your security team should do

• Prioritize kernel updates on any system exposing OCFS2 mounts to untrusted images
• Monitor EPSS and KEV status for changes indicating increased exploitation likelihood
• Restrict mounting of untrusted OCFS2 volumes until patched