CVE-2024-47677

What it actually does

A memory leak occurs in the exfat filesystem driver when exfat_load_upcase_table returns -EINVAL without freeing allocated memory, followed by additional allocations in exfat_load_default_upcase_table.

Why it matters to the business

Gradual memory exhaustion on affected Linux systems using exfat filesystems can degrade performance, trigger out-of-memory conditions, or cause service disruptions especially under repeated mount operations.

How an attack unfolds

Attackers supply a crafted exfat filesystem image designed to force exfat_load_upcase_table into the error path, triggering the unfreed allocation repeatedly; while direct code execution is not enabled, sustained triggering leads to resource exhaustion and potential denial of service.

How to fix it

Apply the upstream kernel patch resolving the leak in exfat_create_upcase_table; update to the corrected kernel version containing the fix. Where downstream packages list remediation, upgrade loofah (RubyGems) to version 2.19.1.

How to confirm the fix worked

Confirm the presence of the memory-leak fix in the running kernel source or changelog; test by attempting to mount images that previously triggered the error path and verify stable memory usage.

Typical attack path

1. Prepare a malformed exfat volume image that induces -EINVAL from exfat_load_upcase_table
2. Mount the image on a vulnerable Linux kernel
3. Trigger the error path repeatedly via automated or scripted mounts
4. Observe cumulative memory consumption until system impact occurs

How to detect it

Review kernel logs for exfat upcase table errors combined with unexplained memory growth; correlate with mount operations on external or untrusted volumes.

What your security team should do

• Prioritize kernel updates for systems exposing exfat mounts
• Audit exfat usage in production workloads and restrict untrusted volumes
• Incorporate memory-leak regression tests into kernel validation pipelines