LiveActive security incident?Get immediate response
CVE Record

CVE-2024-50211: udf: refactor inode_bmap() to handle error

In the Linux kernel, the following vulnerability has been resolved: udf: refactor inode_bmap() to handle error Refactor inode_bmap() to handle error since udf_next_aext() can return error now. On situations like ftruncate, udf_extend_file() can now detect errors and bail out early without resorting to checking for particular offsets and assuming internal behavior of these functions.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux kernel UDF filesystem error-handling flaw may allow a local, low-privileged user to cause serious confidentiality, integrity, or availability impact. The supplied sources do not describe the exact resulting failure or confirm practical exploitation. Systems using affected kernels and UDF functionality warrant prompt review.

Executive priority

Prioritize internet-facing, shared, and multi-user Linux systems where untrusted local users or workloads exist. Schedule prompt kernel remediation, while recognizing that the evidence supplied does not establish remote or active exploitation.

Technical view

inode_bmap() did not properly propagate errors newly returned by udf_next_aext(). During operations such as ftruncate, udf_extend_file() could rely on offset assumptions instead of detecting the error and exiting early. The listed kernel commits refactor this handling. No CWE or detailed failure mechanism is supplied.

Likely exposure

Exposure is limited to affected Linux kernels where the UDF code path is reachable. The bundle lists versions including 2.6.12, 6.6.59, 6.11.6, and 6.12 as affected, but provides no distribution-specific package mapping. The CVSS vector requires local access with low privileges and no user interaction.

Exploitation context

The supplied CVSS rates exploitation as local, low-complexity, and requiring low privileges. CVE-2024-50211 is not marked as KEV, and the provided sources contain no evidence of active exploitation, public weaponization, or a demonstrated proof of concept.

Researcher notes

The source bundle establishes an error-propagation defect and three stable fixes but omits a CWE, crash trace, reproducer, and concrete corruption mechanism. Researchers should avoid inferring the precise impact solely from the CVSS CIA ratings. Distribution backport status and UDF reachability require separate validation.

Mitigation direction

  • Consult the Linux distribution or appliance vendor for the corrected kernel package.
  • Update to a supported kernel containing the applicable referenced stable fix.
  • Restrict unnecessary local access while affected systems await remediation.
  • Reduce unnecessary UDF filesystem use where operationally feasible and vendor-approved.

Validation and detection

  • Record running kernel versions across Linux hosts and appliances.
  • Check vendor advisories for distribution-specific affected and fixed package versions.
  • Confirm the installed kernel includes the applicable referenced stable commit or backport.
  • Identify systems where UDF functionality is enabled or operationally used.
  • Reboot after kernel updates and verify the corrected kernel is running.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-50211 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
3Timeline events
1ADP providers
4Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux
3.3CVSS 3.1LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L1.81.4CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2024-50211Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2unaffected
LinuxLinux2.6.12, 0, 6.6.59, 6.11.6, 6.12affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.