CVE-2024-41059

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-41059
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-41059.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-41059
Downstream
Related
Published
2024-07-29T14:57:21.616Z
Modified
2026-05-28T03:54:34.332960261Z
Summary
hfsplus: fix uninit-value in copy_name
Details

In the Linux kernel, the following vulnerability has been resolved:

hfsplus: fix uninit-value in copy_name

[syzbot reported] BUG: KMSAN: uninit-value in sizedstrscpy+0xc4/0x160 sizedstrscpy+0xc4/0x160 copyname+0x2af/0x320 fs/hfsplus/xattr.c:411 hfspluslistxattr+0x11e9/0x1a50 fs/hfsplus/xattr.c:750 vfslistxattr fs/xattr.c:493 [inline] listxattr+0x1f3/0x6b0 fs/xattr.c:840 pathlistxattr fs/xattr.c:864 [inline] __dosyslistxattr fs/xattr.c:876 [inline] __sesyslistxattr fs/xattr.c:873 [inline] _x64syslistxattr+0x16b/0x2f0 fs/xattr.c:873 x64syscall+0x2ba0/0x3b50 arch/x86/include/generated/asm/syscalls64.h:195 dosyscallx64 arch/x86/entry/common.c:52 [inline] dosyscall64+0xcf/0x1e0 arch/x86/entry/common.c:83 entrySYSCALL64afterhwframe+0x77/0x7f

Uninit was created at: slabpostallochook mm/slub.c:3877 [inline] slaballocnode mm/slub.c:3918 [inline] kmalloctrace+0x57b/0xbe0 mm/slub.c:4065 kmalloc include/linux/slab.h:628 [inline] hfspluslistxattr+0x4cc/0x1a50 fs/hfsplus/xattr.c:699 vfslistxattr fs/xattr.c:493 [inline] listxattr+0x1f3/0x6b0 fs/xattr.c:840 path_listxattr fs/xattr.c:864 [inline] __dosyslistxattr fs/xattr.c:876 [inline] __sesyslistxattr fs/xattr.c:873 [inline] _x64syslistxattr+0x16b/0x2f0 fs/xattr.c:873 x64syscall+0x2ba0/0x3b50 arch/x86/include/generated/asm/syscalls64.h:195 dosyscallx64 arch/x86/entry/common.c:52 [inline] dosyscall64+0xcf/0x1e0 arch/x86/entry/common.c:83 entrySYSCALL64afterhwframe+0x77/0x7f [Fix] When allocating memory to strbuf, initialize memory to 0.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41059.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
017f8da43e92ddd9989884720b694a512e09ccce
Fixed
72805debec8f7aa342da194fe0ed7bc8febea335
Fixed
c733e24a61cbcff10f660041d6d84d32bb7e4cb4
Fixed
34f8efd2743f2d961e92e8e994de4c7a2f9e74a0
Fixed
d02d8c1dacafb28930c39e16d48e40bb6e4cbc70
Fixed
22999936b91ba545ce1fbbecae6895127945e91c
Fixed
f08956d8e0f80fd0d4ad84ec917302bb2f3a9c6a
Fixed
ad57dc2caf1e0a3c0a9904400fae7afbc9f74bb2
Fixed
0570730c16307a72f8241df12363f76600baf57d

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-41059.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.16.0
Fixed
4.19.319
Type
ECOSYSTEM
Events
Introduced
4.20.0
Fixed
5.4.281
Type
ECOSYSTEM
Events
Introduced
5.5.0
Fixed
5.10.223
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.164
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.101
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.42
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.9.11

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-41059.json"