CVE-2024-53147

What it actually does

Out-of-bounds directory entry access in the exfat driver when start_clu becomes an invalid EOF cluster due to filesystem corruption, allowing reads or writes beyond allocated directory bounds.

Why it matters to the business

Filesystem corruption, potential data loss, and system instability on Linux systems using exFAT volumes, with increased urgency from widespread kernel exposure and reported exploitation campaigns by espionage and financially motivated actors.

How an attack unfolds

An attacker supplies or induces a corrupted exFAT volume where a directory's start cluster is marked EOF; the driver follows the stale hint_femp.eidx without validation, dereferencing memory outside the directory buffer and triggering further corruption or crashes. Threat actors have incorporated similar kernel out-of-bounds flaws into zero-day campaigns.

How to fix it

Update the Linux kernel to the commit a0120d6463368378539ef928cf067d02372efb8c or later; rebuild and reboot all affected systems. For distributions shipping exfat, apply the corresponding stable backports.

How to confirm the fix worked

Confirm the patch is present by checking for the added start_clu validity test in fs/exfat/dir.c; attempt to mount a crafted image containing an EOF start cluster and verify the volume is treated as empty without oops or further corruption.

Typical attack path

1. Obtain or craft a malicious exFAT image containing a directory whose start_clu is an invalid EOF cluster
2. Mount the image on a vulnerable kernel or induce the target to mount it via removable media or network share
3. Trigger directory enumeration or file operations that use the stale hint_femp.eidx
4. Cause out-of-bounds read/write leading to further metadata corruption or kernel panic

How to detect it

Search kernel logs for exfat oops or warning messages referencing invalid clusters or directory entry access; inspect mounts of external exFAT volumes around the time of suspected incidents; correlate with any sudden filesystem errors on removable media.

What your security team should do

• Prioritize kernel updates on all systems that mount exFAT volumes, especially servers and endpoints exposed to untrusted media
• Monitor EPSS trend and threat actor activity; treat as higher priority given listed espionage and financial campaigns
• Restrict exFAT mounts to trusted sources until patches are deployed
• Audit logs for exfat-related oops or corruption messages after applying fixes