GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-50247 (GCVE-0-2024-50247)

Vulnerability from cvelistv5 – Published: 2024-11-09 10:14 – Updated: 2026-08-05 11:42
VLAI
Title
fs/ntfs3: Check if more than chunk-size bytes are written
Summary
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Check if more than chunk-size bytes are written A incorrectly formatted chunk may decompress into more than LZNT_CHUNK_SIZE bytes and a index out of bounds will occur in s_max_off.
Severity
7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 20:15 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4534a70b7056fd4b9a1c6db5a4ce3c98546b291e , < e5ae7859008688626b4d2fa6139eeaa08e255053 (git)
Affected: 4534a70b7056fd4b9a1c6db5a4ce3c98546b291e , < 1b6bc5f7212181093b6c5310eea216fc09c721a9 (git)
Affected: 4534a70b7056fd4b9a1c6db5a4ce3c98546b291e , < 5f21e3e60982cd7353998b4f59f052134fd47d64 (git)
Affected: 4534a70b7056fd4b9a1c6db5a4ce3c98546b291e , < 4a4727bc582832f354e0d3d49838a401a28ae25e (git)
Affected: 4534a70b7056fd4b9a1c6db5a4ce3c98546b291e , < 9931122d04c6d431b2c11b5bb7b10f28584067f0 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 5.15.171 , ≤ 5.15.* (semver)
Unaffected: 6.1.116 , ≤ 6.1.* (semver)
Unaffected: 6.6.60 , ≤ 6.6.* (semver)
Unaffected: 6.11.7 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-50247",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T20:15:58.403606Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "CWE-125 Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:17:25.362Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:27:27.327Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/lznt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e5ae7859008688626b4d2fa6139eeaa08e255053",
              "status": "affected",
              "version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e",
              "versionType": "git"
            },
            {
              "lessThan": "1b6bc5f7212181093b6c5310eea216fc09c721a9",
              "status": "affected",
              "version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e",
              "versionType": "git"
            },
            {
              "lessThan": "5f21e3e60982cd7353998b4f59f052134fd47d64",
              "status": "affected",
              "version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e",
              "versionType": "git"
            },
            {
              "lessThan": "4a4727bc582832f354e0d3d49838a401a28ae25e",
              "status": "affected",
              "version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e",
              "versionType": "git"
            },
            {
              "lessThan": "9931122d04c6d431b2c11b5bb7b10f28584067f0",
              "status": "affected",
              "version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/lznt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.171",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.116",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.60",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.171",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.116",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.60",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.7",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Check if more than chunk-size bytes are written\n\nA incorrectly formatted chunk may decompress into\nmore than LZNT_CHUNK_SIZE bytes and a index out of bounds\nwill occur in s_max_off."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The malformed LZNT chunk is delivered on a locally attached or loop-backed NTFS block device and is consumed through ordinary local file I/O (`read`/`mmap` \u2192 `ntfs_read_folio` \u2192 `ni_readpage_cmpr` \u2192 `ni_read_frame` \u2192 `decompress_lznt`); no network protocol or remote peer feeds `decompress_chunk()`.\nAC:L - The attacker authors every byte of the compressed chunk, and I confirmed by emulating the loop that an 8-byte chunk (header plus `02 41 FF 0F 42 43`) deterministically emits 4101 bytes and drives `index` past the end of `s_max_off[]`; there is no race, no memory-layout precondition, and the trigger repeats at will.\nPR:L - ntfs3 registers with `FS_REQUIRES_DEV` and no `FS_USERNS_MOUNT`, but udisks2 loop-setup and removable-media automount hand the mount to any active local session on desktop, kiosk, NAS and media-appliance deployments, and ntfs3 mounts default to permissive uid/gid/fmask/dmask. Once mounted, an unprivileged user reaches `decompress_lznt()` by simply reading a compressed file, with no capability check on the path.\nUI:N - The attacker supplies the crafted image, gets it mounted via automount/udisks2, and then performs the triggering `read()`/`mmap()` of the compressed file itself; no action by any other user or administrator is required.\nS:U - The out-of-bounds read, the corrupted decompression state, and any resulting fault all occur inside the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The scan reads kernel memory past the 9-entry global `s_max_off[]` with an attacker-chosen stop threshold (`up - unc`, selectable across [4097, 65535]), so the read is unbounded rather than limited to a few bytes. The resulting `index` feeds `parse_pair()` and therefore changes the `offset`/`length` of the bytes materialized into the frame the attacker reads back, turning the out-of-bounds contents into a binary-search oracle over post-array kernel memory \u2014 which in ntfs3\u0027s module `.rodata` includes relocated pointers, leaking the KASLR base.\nI:L - I traced every store: `offset` is rejected by `if (unc + offset \u003e up) return -EINVAL;` and `length` is truncated by `if (up + length \u003e= unc_end) length = unc_end - up;`, so even with the UB shifts in `parse_pair()` at `index \u003e 12` no write escapes the frame buffer \u2014 there is no memory-corruption or control-flow primitive here. The bounded integrity effect is that the corrupted `index` makes the kernel materialize wrong bytes into the compressed file\u0027s page cache, which the RMW path at `fs/ntfs3/file.c:1039`/`:1104` recompresses and writes back, persisting bad content on a volume other users of that shared media then read.\nA:H - The index-correction loop has no upper bound and keeps advancing until it finds an out-of-bounds qword at least as large as the attacker-selected threshold, so on the common `CONFIG_NTFS3_FS=m` builds it can run past the module\u0027s read-only region into a vmalloc guard page and take a kernel page fault \u2014 an oops, and a full panic on the many embedded and hardened deployments running `panic_on_oops`. On KASAN builds the very first access at `index == 9` is an immediate global-out-of-bounds BUG, which is precisely the syzbot-reported crash class that motivated the later `a93980141253` hardening."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:42:44.376Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e5ae7859008688626b4d2fa6139eeaa08e255053"
        },
        {
          "url": "https://git.kernel.org/stable/c/1b6bc5f7212181093b6c5310eea216fc09c721a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f21e3e60982cd7353998b4f59f052134fd47d64"
        },
        {
          "url": "https://git.kernel.org/stable/c/4a4727bc582832f354e0d3d49838a401a28ae25e"
        },
        {
          "url": "https://git.kernel.org/stable/c/9931122d04c6d431b2c11b5bb7b10f28584067f0"
        }
      ],
      "title": "fs/ntfs3: Check if more than chunk-size bytes are written",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50247",
    "datePublished": "2024-11-09T10:14:56.165Z",
    "dateReserved": "2024-10-21T19:36:19.978Z",
    "dateUpdated": "2026-08-05T11:42:44.376Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-50247",
      "date": "2026-09-17",
      "epss": "0.00228",
      "percentile": "0.13755"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T14:13:36.000Z",
      "cve": "CVE-2024-50247",
      "id": "msrc_CVE-2024-50247",
      "initial_release_date": "2024-11-02T00:00:00.000Z",
      "product_status:fixed": "5",
      "product_status:known_affected": "5",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "fs/ntfs3: Check if more than chunk-size bytes are written",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-50247.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-50247\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-11-09T11:15:10.600\",\"lastModified\":\"2026-08-04T11:21:36.293\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfs/ntfs3: Check if more than chunk-size bytes are written\\n\\nA incorrectly formatted chunk may decompress into\\nmore than LZNT_CHUNK_SIZE bytes and a index out of bounds\\nwill occur in s_max_off.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: fs/ntfs3: Verificar si se escriben m\u00e1s bytes que el tama\u00f1o de un fragmento. Un fragmento con un formato incorrecto puede descomprimirse en m\u00e1s de LZNT_CHUNK_SIZE bytes y se producir\u00e1 un \u00edndice fuera de los l\u00edmites en s_max_off.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ntfs3/lznt.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4534a70b7056fd4b9a1c6db5a4ce3c98546b291e\",\"lessThan\":\"e5ae7859008688626b4d2fa6139eeaa08e255053\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4534a70b7056fd4b9a1c6db5a4ce3c98546b291e\",\"lessThan\":\"1b6bc5f7212181093b6c5310eea216fc09c721a9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4534a70b7056fd4b9a1c6db5a4ce3c98546b291e\",\"lessThan\":\"5f21e3e60982cd7353998b4f59f052134fd47d64\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4534a70b7056fd4b9a1c6db5a4ce3c98546b291e\",\"lessThan\":\"4a4727bc582832f354e0d3d49838a401a28ae25e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4534a70b7056fd4b9a1c6db5a4ce3c98546b291e\",\"lessThan\":\"9931122d04c6d431b2c11b5bb7b10f28584067f0\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ntfs3/lznt.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.171\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.116\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.60\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.7\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H\",\"baseScore\":7.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.5},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T20:15:58.403606Z\",\"id\":\"CVE-2024-50247\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.15.171\",\"matchCriteriaId\":\"1AC64A10-7663-4FE4-948B-2338EFB3EC2C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.116\",\"matchCriteriaId\":\"43EFDC15-E4D4-4F1E-B70D-62F0854BFDF3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.60\",\"matchCriteriaId\":\"75088E5E-2400-4D20-915F-7A65C55D9CCD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.11.7\",\"matchCriteriaId\":\"E96F53A4-5E87-4A70-BD9A-BC327828D57F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1b6bc5f7212181093b6c5310eea216fc09c721a9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4a4727bc582832f354e0d3d49838a401a28ae25e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5f21e3e60982cd7353998b4f59f052134fd47d64\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9931122d04c6d431b2c11b5bb7b10f28584067f0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e5ae7859008688626b4d2fa6139eeaa08e255053\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-14T12:24:36+00:00",
      "cve": "CVE-2024-50247",
      "id": "CVE-2024-50247",
      "initial_release_date": "2024-11-09T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: fs/ntfs3: Check if more than chunk-size bytes are written",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-50247.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:27:27.327Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.1, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-50247\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T20:15:58.403606Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-125\", \"description\": \"CWE-125 Out-of-bounds Read\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T15:24:43.078Z\"}}], \"cna\": {\"title\": \"fs/ntfs3: Check if more than chunk-size bytes are written\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4534a70b7056fd4b9a1c6db5a4ce3c98546b291e\", \"lessThan\": \"e5ae7859008688626b4d2fa6139eeaa08e255053\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4534a70b7056fd4b9a1c6db5a4ce3c98546b291e\", \"lessThan\": \"1b6bc5f7212181093b6c5310eea216fc09c721a9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4534a70b7056fd4b9a1c6db5a4ce3c98546b291e\", \"lessThan\": \"5f21e3e60982cd7353998b4f59f052134fd47d64\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4534a70b7056fd4b9a1c6db5a4ce3c98546b291e\", \"lessThan\": \"4a4727bc582832f354e0d3d49838a401a28ae25e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4534a70b7056fd4b9a1c6db5a4ce3c98546b291e\", \"lessThan\": \"9931122d04c6d431b2c11b5bb7b10f28584067f0\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/ntfs3/lznt.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.15\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.15\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.171\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.116\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.60\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/ntfs3/lznt.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e5ae7859008688626b4d2fa6139eeaa08e255053\"}, {\"url\": \"https://git.kernel.org/stable/c/1b6bc5f7212181093b6c5310eea216fc09c721a9\"}, {\"url\": \"https://git.kernel.org/stable/c/5f21e3e60982cd7353998b4f59f052134fd47d64\"}, {\"url\": \"https://git.kernel.org/stable/c/4a4727bc582832f354e0d3d49838a401a28ae25e\"}, {\"url\": \"https://git.kernel.org/stable/c/9931122d04c6d431b2c11b5bb7b10f28584067f0\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfs/ntfs3: Check if more than chunk-size bytes are written\\n\\nA incorrectly formatted chunk may decompress into\\nmore than LZNT_CHUNK_SIZE bytes and a index out of bounds\\nwill occur in s_max_off.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.171\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.116\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.60\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.7\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"5.15\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:48:21.638Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-50247\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:48:21.638Z\", \"dateReserved\": \"2024-10-21T19:36:19.978Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-11-09T10:14:56.165Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.