GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-52560 (GCVE-0-2024-52560)

Vulnerability from cvelistv5 – Published: 2025-02-27 02:18 – Updated: 2026-09-14 11:57
VLAI
Title
fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr()
Summary
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr() Extended the `mi_enum_attr()` function interface with an additional parameter, `struct ntfs_inode *ni`, to allow marking the inode as bad as soon as an error is detected.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4534a70b7056fd4b9a1c6db5a4ce3c98546b291e , < 4ff4b6b9e85cfe879773ca78d91b1090a3ce19ac (git)
Affected: 4534a70b7056fd4b9a1c6db5a4ce3c98546b291e , < acfb75eeb3304d08cbd5b5a8c77379459ec6a04e (git)
Affected: 4534a70b7056fd4b9a1c6db5a4ce3c98546b291e , < d9c699f2c4dc174940ffe8600b20c267897da155 (git)
Affected: 4534a70b7056fd4b9a1c6db5a4ce3c98546b291e , < 2afd4d267e6dbaec8d3ccd4f5396cb84bc67aa2e (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.13.4 , ≤ 6.13.* (semver)
Unaffected: 6.14 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/attrib.c",
            "fs/ntfs3/frecord.c",
            "fs/ntfs3/ntfs_fs.h",
            "fs/ntfs3/record.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4ff4b6b9e85cfe879773ca78d91b1090a3ce19ac",
              "status": "affected",
              "version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e",
              "versionType": "git"
            },
            {
              "lessThan": "acfb75eeb3304d08cbd5b5a8c77379459ec6a04e",
              "status": "affected",
              "version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e",
              "versionType": "git"
            },
            {
              "lessThan": "d9c699f2c4dc174940ffe8600b20c267897da155",
              "status": "affected",
              "version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e",
              "versionType": "git"
            },
            {
              "lessThan": "2afd4d267e6dbaec8d3ccd4f5396cb84bc67aa2e",
              "status": "affected",
              "version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/attrib.c",
            "fs/ntfs3/frecord.c",
            "fs/ntfs3/ntfs_fs.h",
            "fs/ntfs3/record.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.4",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr()\n\nExtended the `mi_enum_attr()` function interface with an additional\nparameter, `struct ntfs_inode *ni`, to allow marking the inode\nas bad as soon as an error is detected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The corrupt MFT record arrives on a locally attached or loop-backed block device and is triggered through ordinary local path resolution and file operations (the syzbot trace is `__do_sys_mount` \u2192 `user_path_at` \u2192 `path_lookupat` \u2192 `step_into` \u2192 `pick_link`); no network protocol or remote peer feeds `mi_enum_attr()`.\nAC:L - The attacker authors the entire on-disk MFT record, so which validation check in `mi_enum_attr()` fails and where enumeration silently truncates is fully deterministic, and the stale `i_dir_seq`/`i_link` union value is influenced by ordinary directory operations the attacker performs; no race and no memory-layout condition lies outside the attacker\u0027s control, and the trigger is repeatable at will.\nPR:L - ntfs3 registers without `FS_USERNS_MOUNT`, but udisks2 loop-setup/filesystem-mount and removable-media automount hand the mount to any active local session on desktop, kiosk, NAS and media-appliance deployments, and ntfs3 mounts default to permissive uid/gid/fmask/dmask; once mounted, an unprivileged user reaches the fault through plain pathname resolution and truncate/write with no capability check anywhere on the path.\nUI:N - The attacker supplies the crafted image, gets it mounted via automount/udisks2, and then performs the triggering lookup and `attr_set_size`-inducing write itself; no action by any other user or administrator is required.\nS:U - The wild-pointer dereference, the inode/dentry type desynchronization, and the on-disk metadata damage all occur within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `pick_link()` dereferences `inode-\u003ei_link`, which ntfs3 never sets and which is a union aliasing `i_pipe`/`i_cdev`/`i_dir_seq` \u2014 an attacker-influenced value that path resolution then reads as a NUL-terminated string and consumes as a path, giving a steerable kernel read primitive on configurations without KASAN; the freed-but-still-referenced MFT records from `ni_write_inode()` additionally cross-link attributes and clusters between unrelated files.\nI:H - The bogus symlink body redirects path resolution to attacker-chosen targets, and the write path corrupts persistent state \u2014 `ni_write_inode()` calls `clear_rec_inuse()` plus `ntfs_mark_rec_free()` on records that still hold live attributes, while `mi_insert_attr()` `memmove`/`memset`s a new attribute over live attribute bytes at `rec-\u003eused - 8` and bumps `rec-\u003eused`, with both written back to disk and re-parsed later.\nA:H - syzbot reproduced a general protection fault / KASAN null-ptr-deref at `pick_link+0x51c` (fs/namei.c:1864) five times across 6.12-rc6 through 6.15, oopsing the task mid-path-resolution \u2014 a full panic on the many embedded and hardened deployments running `panic_on_oops`, and otherwise a tainted kernel with leaked path/mount references and a volume flagged `NTFS_DIRTY_ERROR`."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T11:57:47.206Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4ff4b6b9e85cfe879773ca78d91b1090a3ce19ac"
        },
        {
          "url": "https://git.kernel.org/stable/c/acfb75eeb3304d08cbd5b5a8c77379459ec6a04e"
        },
        {
          "url": "https://git.kernel.org/stable/c/d9c699f2c4dc174940ffe8600b20c267897da155"
        },
        {
          "url": "https://git.kernel.org/stable/c/2afd4d267e6dbaec8d3ccd4f5396cb84bc67aa2e"
        }
      ],
      "title": "fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-52560",
    "datePublished": "2025-02-27T02:18:07.676Z",
    "dateReserved": "2025-02-27T02:16:34.069Z",
    "dateUpdated": "2026-09-14T11:57:47.206Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-52560",
      "date": "2026-09-20",
      "epss": "0.00214",
      "percentile": "0.12036"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/ntfs3/attrib.c",
                  "fs/ntfs3/frecord.c",
                  "fs/ntfs3/ntfs_fs.h",
                  "fs/ntfs3/record.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "4ff4b6b9e85cfe879773ca78d91b1090a3ce19ac",
                    "status": "affected",
                    "version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "acfb75eeb3304d08cbd5b5a8c77379459ec6a04e",
                    "status": "affected",
                    "version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d9c699f2c4dc174940ffe8600b20c267897da155",
                    "status": "affected",
                    "version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2afd4d267e6dbaec8d3ccd4f5396cb84bc67aa2e",
                    "status": "affected",
                    "version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/ntfs3/attrib.c",
                  "fs/ntfs3/frecord.c",
                  "fs/ntfs3/ntfs_fs.h",
                  "fs/ntfs3/record.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.15"
                  },
                  {
                    "lessThan": "5.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.13.*",
                    "status": "unaffected",
                    "version": "6.13.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.14",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CD85CE5A-FCD7-4639-9FA5-2FFDE65EF0EE",
                    "versionEndExcluding": "6.13.4",
                    "versionStartIncluding": "5.15",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr()\n\nExtended the `mi_enum_attr()` function interface with an additional\nparameter, `struct ntfs_inode *ni`, to allow marking the inode\nas bad as soon as an error is detected."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: fs/ntfs3: Marcar el inodo como defectuoso tan pronto como se detecte un error en mi_enum_attr() Se ampli\u00f3 la interfaz de la funci\u00f3n `mi_enum_attr()` con un par\u00e1metro adicional, `struct ntfs_inode *ni`, para permitir marcar el inodo como defectuoso tan pronto como se detecte un error."
          }
        ],
        "id": "CVE-2024-52560",
        "lastModified": "2026-09-14T12:17:33.867",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-02-27T03:15:10.573",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2afd4d267e6dbaec8d3ccd4f5396cb84bc67aa2e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4ff4b6b9e85cfe879773ca78d91b1090a3ce19ac"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/acfb75eeb3304d08cbd5b5a8c77379459ec6a04e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d9c699f2c4dc174940ffe8600b20c267897da155"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:39:35+00:00",
      "cve": "CVE-2024-52560",
      "id": "CVE-2024-52560",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-52560.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.