Security readout for executives and security teams
Plain-English summary
A flaw in Linux XFS log recovery can make the kernel access memory outside an allocated buffer when processing an invalid log header size. This could threaten system availability and data confidentiality. Exploitation requires local interaction with a problematic XFS filesystem; the supplied evidence does not show active exploitation.
Executive priority
Treat this as a high-priority kernel maintenance issue, especially where systems process external storage. Expedite patching for exposed XFS workflows. For ordinary managed servers with controlled storage, schedule prompt remediation while confirming vendor-specific affected and fixed versions. Current sources do not support an emergency response based on active exploitation.
Technical view
A prior XFS change corrected legacy log-header h_size values, but later recovery-buffer calculations stopped using that corrected value. A crafted or fuzzed invalid value can therefore produce an undersized buffer and an out-of-bounds access during log recovery. Referenced Linux stable commits correct the header-block calculation.
Likely exposure
Exposure is limited to systems running affected Linux kernel builds that use XFS and encounter an invalid log during recovery. Systems processing externally supplied disks, images, or removable media may face greater risk. The supplied version metadata is ambiguous, so distribution-specific package status must be verified.
Exploitation context
The CVSS vector describes a local, low-complexity issue requiring user interaction but no privileges, with potentially high confidentiality and availability impact. The bundle marks KEV false and provides no cited evidence of active exploitation. The triggering condition was demonstrated through fuzzing.
Researcher notes
The regression traces to commit 0c771b99d6c9, which calculated recovery-buffer header blocks without the corrected h_size. The fix open-codes that calculation using the adjusted value. The supplied affected-version entries are incomplete or ambiguous, including duplicated commit identifiers, so exact exposure requires git ancestry or distribution backport analysis.
Mitigation direction
- Apply a vendor-supported kernel update containing the applicable referenced stable fix or backport.
- Check distribution security guidance for the exact fixed kernel package and branch.
- Prioritize systems that mount or recover externally supplied XFS filesystems.
- Restrict handling of untrusted XFS volumes until the running kernel is remediated.
Validation and detection
- Inventory running kernel versions and systems using XFS filesystems.
- Confirm the running kernel contains the referenced fix or a documented vendor backport.
- Compare installed kernel packages against applicable distribution security advisories.
- Identify workflows accepting external disk images, removable media, or other XFS volumes.
- Verify the remediated kernel is running, rather than merely installed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-39472 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H1.85.5LinuxVulnerability scoring details
Base CVSS 3.1 score
7.3HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/f754591b17d0ee91c2b45fe9509d0cdc420527cbCVE reference, Linux
- https://git.kernel.org/stable/c/57835c0e7152e36b03875dd6c56dfeed685c1b1fCVE reference, Linux
- https://git.kernel.org/stable/c/c2389c074973aa94e34992e7f66dac0de37595b5CVE reference, Linux
- https://git.kernel.org/stable/c/45cf976008ddef4a9c9a30310c9b4fb2a9a6602aCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.