CVE-2024-57943

What it actually does

Uninitialized data from the page cache can be written to disk when a buffer_head marked new is not zeroed before write_end in the exfat driver.

Why it matters to the business

Sensitive information previously present in kernel memory may leak into files stored on exFAT volumes, increasing risk of data exposure on systems using the affected kernel versions.

How an attack unfolds

An attacker with the ability to trigger file writes on an exFAT filesystem can cause the kernel to persist residual page-cache contents into newly allocated file blocks, after which the attacker reads those blocks from the filesystem to recover the leaked data.

How to fix it

Update to a fixed kernel version that applies the exfat change using folio_zero_new_buffers before write_end; for the listed Red Hat packages this corresponds to version 3.10.0-327.22.2.rt56.230.el7_2 or the upstream commit 942c6f91ab8d82a41650e717940b4e577173762f.

How to confirm the fix worked

Confirm the running kernel contains the fix by checking for the presence of folio_zero_new_buffers calls in the exfat write path or by verifying the package version matches the fixed release.

Typical attack path

1. Mount an exFAT volume on a vulnerable kernel
2. Trigger allocation of new buffers via file creation or extension operations
3. Cause the kernel to write those buffers without zeroing
4. Read the resulting file blocks from the exFAT volume to extract residual memory contents

How to detect it

Review system logs and file creation events on exFAT volumes for unexpected non-zero data patterns at the start of newly allocated clusters; no specific runtime indicators are published for this class of write-initialization flaw.

What your security team should do

• Prioritize patching kernel-rt packages on any system that mounts exFAT volumes
• Apply the fixed version 3.10.0-327.22.2.rt56.230.el7_2 (or later) across affected Red Hat realtime kernels
• Rebuild and redeploy any custom kernels that incorporate the exfat driver