CVE-2024-50246

What it actually does

Missing input validation on attribute allocation size in the ntfs3 filesystem driver allows crafted on-disk structures to trigger out-of-bounds memory access or resource misuse.

Why it matters to the business

Local users on affected Linux systems can obtain elevated privileges, potentially leading to full host compromise, data theft, or persistence; the low EPSS and absence from KEV indicate limited in-the-wild use so far, but the high CVSS and kernel context still require prompt patching on any system exposing ntfs3 volumes.

How an attack unfolds

An attacker with local access crafts a malicious NTFS image containing an attribute record with an invalid alloc_size value, mounts it on a vulnerable kernel, and triggers the ntfs3 code path that lacks the size check, resulting in memory corruption that is then turned into arbitrary code execution or privilege escalation.

How to fix it

Update the Linux kernel to a version containing the ntfs3 alloc_size validation fix; if a fixed package is unavailable for the distribution, apply the upstream patch or disable ntfs3 mounts until the kernel is upgraded.

How to confirm the fix worked

Confirm the running kernel version contains the commit that added the rough attr alloc_size check; attempt to mount a test image containing an out-of-range alloc_size value and verify the operation is rejected or logged rather than causing a crash or corruption.

Typical attack path

1. Obtain local shell on target system
2. Prepare malicious NTFS filesystem image with oversized or malformed attribute allocation records
3. Mount the image using the ntfs3 driver
4. Trigger the vulnerable attribute parsing routine
5. Leverage resulting memory corruption for privilege escalation

How to detect it

Review kernel logs for ntfs3 warnings or oops entries referencing attribute allocation sizes; look for unexpected mounts of NTFS volumes followed by privilege-escalation events in audit logs.

What your security team should do

• Prioritize kernel updates on any system that mounts untrusted NTFS volumes
• Add monitoring for ntfs3-related kernel oops or warning messages
• Restrict unprivileged mount capabilities via mount namespaces or user namespaces where feasible