CVE-2024-50143

What it actually does

Use of uninitialized value in udf_get_fileshortad triggered by missing overflow check when computing alen in udf_current_aext within UDF filesystem code, leading to memory corruption.

Why it matters to the business

Potential kernel instability, crashes, or information disclosure on affected systems using UDF, with elevated urgency due to mentions in 2024 zero-day campaigns by espionage and financially motivated actors and high ecosystem prevalence in downstream dependents.

How an attack unfolds

Attacker supplies a specially crafted UDF image that bypasses length checks to reach uninitialized memory paths in udf_get_fileshortad; observed in Linux Kernel Use of Uninitialized Resource and Out-of-Bounds Access campaigns by espionage and financially motivated actors.

How to fix it

Upgrade firefox to 41.0+build3-0ubuntu0.14.04.1 and thunderbird to 1:38.3.0+build1-0ubuntu0.14.04.1 on Ubuntu 14.04 LTS; apply kernel patches addressing the alen overflow check.

How to confirm the fix worked

Confirm package versions match listed fixed releases; reproduce with syzkaller-style UDF test cases to verify no KMSAN uninit-value reports occur.

Typical attack path

1. Craft malicious UDF filesystem image containing crafted allocation structures
2. Mount or access the image on vulnerable kernel triggering udf_current_aext
3. Induce overflow condition leading to uninit-value use in udf_get_fileshortad
4. Leverage resulting memory corruption for crash or further exploitation

How to detect it

Review kernel logs for UDF-related KMSAN or uninitialized value warnings; inspect mount operations on untrusted UDF images referenced in Linux Kernel Out-of-Bounds campaigns.

What your security team should do

• Prioritize patching affected Ubuntu packages within kev timelines if applicable
• Monitor EPSS trend stability and threat actor reports for Linux kernel UDF issues
• Audit systems for UDF filesystem usage and restrict untrusted media mounting