CVE-2024-41019

MediumCVSS 5.5/10Last modified Aug 4, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Validate ff offset

This adds sanity checks for ff offset. There is a check on rt->first_free at first, but walking through by ff without any check. If the second ff is a large offset. We may encounter an out-of-bound read.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125

Affected software

VendorProductVersions
LinuxLinux>= 4534a70b7056fd4b9a1c6db5a4ce3c98546b291e, < 35652dfa8cc9a8a900ec0f1e0395781f94ffc5f0; >= 4534a70b7056fd4b9a1c6db5a4ce3c98546b291e, < 818a257428644b8873e79c44404d8fb6598d4440; >= 4534a70b7056fd4b9a1c6db5a4ce3c98546b291e, < 6ae7265a7b816879fd0203e83b5030d3720bbb7a; >= 4534a70b7056fd4b9a1c6db5a4ce3c98546b291e, < 82c94e6a7bd116724738aa67eba6f5fedf3a3319; >= 4534a70b7056fd4b9a1c6db5a4ce3c98546b291e, < 617cf144c206f98978ec730b17159344fd147cb4; >= 4534a70b7056fd4b9a1c6db5a4ce3c98546b291e, < 50c47879650b4c97836a0086632b3a2e300b0f06
LinuxLinux5.15

References

Timeline

Published
Jul 29, 2024
Last modified
Aug 4, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-41025.4The Pricing Table plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax() functionCVE-2024-410204.7In the Linux kernel, the following vulnerability has been resolved: filelock: Fix fcntl/close race recovery compat path When I wrote commiCVE-2024-410215.5In the Linux kernel, the following vulnerability has been resolved: s390/mm: Fix VM_FAULT_HWPOISON handling in do_exception() There is no CVE-2024-410225.5In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() The "inCVE-2024-410235.5In the Linux kernel, the following vulnerability has been resolved: sched/deadline: Fix task_struct reference leak During the execution ofCVE-2024-410255.5In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Fix memory leak in audio daemon attach operation Audio CVE-2024-410265.5In the Linux kernel, the following vulnerability has been resolved: mmc: davinci_mmc: Prevent transmitted data size from exceeding sgm's leCVE-2024-410273.3In the Linux kernel, the following vulnerability has been resolved: Fix userfaultfd_api to return EINVAL as expected Currently if we requeCVE-2024-410287.8In the Linux kernel, the following vulnerability has been resolved: platform/x86: toshiba_acpi: Fix array out-of-bounds access In order toCVE-2024-410295.5In the Linux kernel, the following vulnerability has been resolved: nvmem: core: limit cell sysfs permissions to main attribute ones The cCVE-2024-41034.3The ADFO – Custom data in admin dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includCVE-2024-410305.5In the Linux kernel, the following vulnerability has been resolved: ksmbd: discard write access to the directory open may_open() does not
CVE-2024-41019: Medium severity, CVSS 5.5 | Vulnix