CVE-2024-50248

What it actually does

Missing bounds checking in mi_enum_attr() permits NTFS attributes to access memory outside the valid region, enabling out-of-bounds reads or writes in the kernel.

Why it matters to the business

May cause system instability, crashes, or unauthorized code execution on Linux systems handling NTFS volumes, increasing operational risk especially in environments with untrusted filesystems.

How an attack unfolds

Attackers supply a crafted NTFS image or metadata that causes mi_enum_attr() to stray beyond allocated memory during attribute enumeration; observed in 2024 zero-day campaigns by espionage and financially motivated actors targeting Linux kernel out-of-bounds issues.

How to fix it

Apply the kernel patch adding bounds checks to mi_enum_attr(); upgrade affected packages to flashplugin-nonfree (Ubuntu:14.04:LTS): fixed in 11.2.202.535ubuntu0.14.04.1 where applicable.

How to confirm the fix worked

Confirm kernel source includes the bounds check in mi_enum_attr(); verify package versions match the listed fixed releases and test with malformed NTFS images.

Typical attack path

1. Prepare malicious NTFS filesystem image with oversized or malformed attributes
2. Cause the vulnerable kernel to mount or enumerate attributes on the image
3. Trigger mi_enum_attr() to perform out-of-bounds memory access
4. Leverage resulting memory corruption for further exploitation or denial of service

How to detect it

Review kernel logs for oops or panic messages involving ntfs3 and mi_enum_attr; inspect for unexpected attribute enumeration failures or memory access violations in system audit trails.

What your security team should do

• Prioritize patching Linux kernels using ntfs3 on systems exposed to untrusted NTFS media
• Monitor EPSS trend and threat actor activity for any increase in exploitation attempts
• Restrict mounting of external or untrusted NTFS volumes until patched