CVE-2024-57943

In the Linux kernel, the following vulnerability has been resolved:

exfat: fix the new buffer was not zeroed before writing

Before writing, if a buffer_head marked as new, its data must be zeroed, otherwise uninitialized data in the page cache will be written.

So this commit uses folio_zero_new_buffers() to zero the new buffers before ->write_end().

This vulnerability is rated as Moderate impact because exploitation requires local write access to a mounted exFAT filesystem, restricting the blast radius to local uninitialized memory disclosure rather than privilege escalation or remote code execution. Under typical Red Hat deployments, exFAT filesystems are uncommon and primarily used for removable media. The flaw stems from newly allocated filesystem buffer heads being persisted to media without first clearing existing page cache data. Red Hat Enterprise Linux releases are not affected, as the upstream commit introducing this regression is not present in supported kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.