Security readout for executives and security teams
Plain-English summary
A Linux HFS+ filesystem flaw can expose uninitialized kernel memory when extended-attribute names are listed. It requires local, low-privileged access and use of the affected HFS+ path. The supplied CVSS score is 7.8, but the bundle provides no evidence of active exploitation.
Executive priority
Treat this as high-priority kernel maintenance for multi-user systems or endpoints handling HFS+ media. It is not supported as an internet-scale emergency because the documented attack vector is local and active exploitation is not evidenced. Prioritize exposed systems, then apply normal fleet-wide kernel remediation.
Technical view
KMSAN detected an uninitialized-value use in copy_name during hfsplus_listxattr. The allocated string buffer was not zero-initialized before sized_strscpy processed it. The upstream correction initializes that memory to zero. The supplied vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Likely exposure
Exposure is concentrated on systems running a listed affected Linux kernel and using HFS+ filesystems, particularly where low-privileged users can access them. Specific listed releases range from 3.16 through 6.10; distribution backports may alter status. Systems not using HFS+ have substantially reduced practical exposure.
Exploitation context
The CVSS vector describes a local, low-complexity path requiring low privileges and no user interaction. The source bundle marks KEV false and contains no cited evidence of active exploitation, public exploit availability, or demonstrated real-world compromise. Practical impact beyond the KMSAN finding remains incompletely documented.
Researcher notes
The finding originated from syzbot and KMSAN in the HFS+ listxattr path. The prescribed fix zero-initializes the allocated strbuf. No CWE is supplied. The bundle does not establish exploitability beyond the sanitizer finding, and its affected-version presentation requires distribution-level confirmation.
Mitigation direction
- Install a distribution kernel containing the applicable upstream stable fix, following vendor guidance.
- Reboot into the updated kernel and verify the patched version is running.
- If patching is delayed, restrict unnecessary HFS+ mounting and access where operationally feasible.
- Track distribution advisories because backported fixes may not correspond directly to upstream version numbers.
Validation and detection
- Inventory running kernel releases and compare them with vendor-specific CVE status.
- Identify systems with HFS+ support enabled, loaded, or actively mounted.
- Confirm the installed kernel package includes the applicable stable-branch fix commit.
- After updating, verify the host booted the intended patched kernel.
- Use authorized laboratory testing to confirm KMSAN no longer reports this uninitialized-value condition.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-41059 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/72805debec8f7aa342da194fe0ed7bc8febea335CVE reference, Linux
- https://git.kernel.org/stable/c/c733e24a61cbcff10f660041d6d84d32bb7e4cb4CVE reference, Linux
- https://git.kernel.org/stable/c/34f8efd2743f2d961e92e8e994de4c7a2f9e74a0CVE reference, Linux
- https://git.kernel.org/stable/c/d02d8c1dacafb28930c39e16d48e40bb6e4cbc70CVE reference, Linux
- https://git.kernel.org/stable/c/22999936b91ba545ce1fbbecae6895127945e91cCVE reference, Linux
- https://git.kernel.org/stable/c/f08956d8e0f80fd0d4ad84ec917302bb2f3a9c6aCVE reference, Linux
- https://git.kernel.org/stable/c/ad57dc2caf1e0a3c0a9904400fae7afbc9f74bb2CVE reference, Linux
- https://git.kernel.org/stable/c/0570730c16307a72f8241df12363f76600baf57dCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.