Security readout for executives and security teams
Plain-English summary
A malformed UDF filesystem can declare partition sizes that exceed limits safely handled by the Linux kernel. Mounting it may undermine system confidentiality, integrity, or availability. Risk is highest where Linux systems accept removable media or user-controlled filesystem images.
Executive priority
Treat this as high-priority kernel maintenance for systems handling untrusted storage. Accelerate remediation on shared hosts, workstations, and media-processing systems. With no supplied evidence of active exploitation and a local attack vector, the evidence does not support declaring an organization-wide emergency solely from this record.
Technical view
The UDF driver did not adequately reject partition lengths that overflow its 32-bit block numbering or make block-bitmap indexing unsafe. The resolved implementation refuses such filesystems during mounting. The supplied CVSS 3.1 score is 7.8, with local access, low complexity, low privileges, no user interaction, and high potential impact.
Likely exposure
Potentially exposed systems run an affected Linux kernel and permit UDF filesystems from untrusted media or images to be mounted. Actual exposure depends on distribution backports, kernel configuration, UDF availability, and mount permissions. The supplied version data does not provide reliable distribution-specific fixed-version boundaries.
Exploitation context
The supplied record marks this CVE as absent from KEV, and no provided source reports active exploitation. The CVSS vector describes a local, low-complexity attack requiring low privileges and no user interaction. Successful triggering appears dependent on mounting a maliciously structured UDF filesystem; exact prerequisites are not fully documented here.
Researcher notes
The fix adds mount-time rejection for partitions exceeding 32-bit block-number capacity or safe bitmap indexing limits. No CWE is supplied. The affected-version list mixes release numbers and commit identifiers and does not clearly map every stable branch boundary; researchers should use distribution advisories and referenced upstream commits for precise applicability.
Mitigation direction
- Install a vendor kernel update containing the referenced UDF fix.
- Prioritize systems that mount removable media or user-supplied filesystem images.
- Restrict untrusted UDF mounting where operationally feasible until updates are applied.
- Check distribution security guidance for backported fixes and exact package versions.
Validation and detection
- Record both the installed and currently running kernel versions.
- Confirm the distribution package includes the referenced UDF correction.
- Identify systems and workflows that permit UDF filesystem mounting.
- Verify updated systems booted into the corrected kernel.
- Review vendor advisories because upstream commit identifiers do not prove package status.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-46777 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/c0c23130d38e8bc28e9ef581443de9b1fc749966CVE reference, Linux
- https://git.kernel.org/stable/c/1497a4484cdb2cf6c37960d788fb6ba67567bdb7CVE reference, Linux
- https://git.kernel.org/stable/c/551966371e17912564bc387fbeb2ac13077c3db1CVE reference, Linux
- https://git.kernel.org/stable/c/2ddf831451357c6da4b64645eb797c93c1c054d1CVE reference, Linux
- https://git.kernel.org/stable/c/0173999123082280cf904bd640015951f194a294CVE reference, Linux
- https://git.kernel.org/stable/c/a56330761950cb83de1dfb348479f20c56c95f90CVE reference, Linux
- https://git.kernel.org/stable/c/925fd8ee80d5348a5e965548e5484d164d19221dCVE reference, Linux
- https://git.kernel.org/stable/c/ebbe26fd54a9621994bc16b14f2ba8f84c089693CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2024/10/msg00003.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.