CVE-2024-50243

What it actually does

Causes a general protection fault in run_is_mapped_full due to improper handling of non-resident attribute deletion during rollback in ntfs_create_inode within the ntfs3 driver.

Why it matters to the business

Leads to system crashes and loss of availability on Linux systems using NTFS file systems; low urgency given stable low EPSS, no KEV listing, and no ransomware use despite mentions in broad Linux kernel exploitation discussions.

How an attack unfolds

A local attacker performs file system operations that invoke ntfs_create_inode with non-resident attributes, triggering the rollback path and the resulting fault; referenced in generic discussions of Linux kernel memory issues by espionage and financially motivated actors but with no confirmed public exploits.

How to fix it

Update affected systems to the fixed package versions such as nova (Ubuntu:14.04:LTS) 1:2014.1.5-0ubuntu1.7; apply kernel patches resolving the ntfs3 rollback handling.

How to confirm the fix worked

Confirm kernel version or package is at or above the listed fixed releases; test ntfs inode creation and rollback scenarios do not produce faults; review changelog for ntfs3 fixes.

Typical attack path

1. Obtain local access on a Linux system
2. Mount or access an NTFS volume using ntfs3
3. Trigger inode creation involving non-resident attributes
4. Force error path leading to rollback in ntfs_create_inode
5. Induce general protection fault

How to detect it

Review kernel logs for oops or panic messages referencing run_is_mapped_full or ntfs_create_inode; correlate with file system activity on ntfs3 volumes.

• run_is_mapped_full
• ntfs_create_inode
• general protection fault
• non-resident attribute

What your security team should do

• Prioritize patching systems exposing NTFS volumes via ntfs3
• Monitor for kernel stability issues on legacy Ubuntu releases
• Restrict local unprivileged access where possible until updated