CVE-2024-56548

A successful exploitation of this vulnerability requires higher-level privileges such as root, which is why the CVSS has been marked as such.

A moderate-impact out-of-bounds write flaw was found in the Linux kernel's hfsplus filesystem implementation, as shipped in Red Hat Enterprise Linux and related kernel offerings. When a privileged local user mounts an hfsplus filesystem on a device whose logical block size changes after the initial query (for example, a loop device reconfigured via the LOOP_SET_BLOCK_SIZE ioctl), hfsplus_read_wrapper can allocate a block using one size while hfsplus_submit_bio reads a different io_size, resulting in an out-of-bounds write, observed by KASAN as a slab-use-after-free in hfsplus_read_wrapper. Exploitation requires local access with root or equivalent administrative privileges (mounting a crafted filesystem and controlling device block sizes), which is why Red Hat Product Security rates this issue as moderate impact with CVSS 6.7 (AV:L/AC:L/PR:H) rather than the important severity assigned by upstream and NIST (CVSS 7.8, PR:L). Per the current assessment, the kernel and kernel-rt packages in Red Hat Enterprise Linux 7, 8, and 9, as well as the Hosted OpenShift (ARO and OSD) offerings, are marked not affected; the Red Hat Enterprise Linux 6 Extended Lifecycle Support kernel stream remains recorded with an out-of-support (OOSS) resolution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.