CVE-2024-40902

A buffer overflow vulnerability was found in the Linux kernel, where the xattr size is bigger than the expected size and was printed to the kernel log in hex format. Printing it out can cause access off the buffer's end,  leading to loss of confidentiality, integrity, and availability.

This vulnerability is rated as having a Moderate impact because exploiting it requires a local attacker to mount a specially corrupted JFS filesystem image, restricting potential attacks to environments where arbitrary filesystem mounting is allowed. The JFS filesystem driver is disabled by default in enterprise Red Hat Enterprise Linux kernels, so standard installations are not exposed to this flaw. In environments where the module is accessible, unprivileged users cannot mount arbitrary storage devices without administrative privileges or user namespace permissions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.