Security readout for executives and security teams
Plain-English summary
A malformed compressed chunk processed by Linux’s ntfs3 filesystem driver can exceed its expected size and cause an out-of-bounds index. A low-privileged local user may be able to compromise confidentiality or crash an affected system. The supplied sources provide no evidence of active exploitation.
Executive priority
Expedite remediation for multi-user systems and systems processing untrusted NTFS media or images. Systems where ntfs3 is absent or unused have lower immediate exposure, but that condition should be verified and documented. There is no supplied evidence of active exploitation.
Technical view
During LZNT decompression, an incorrectly formatted chunk can expand beyond LZNT_CHUNK_SIZE, causing an out-of-bounds condition involving s_max_off. The CVE is classified as CWE-125 with CVSS 3.1 score 7.3: local access, low complexity, low privileges, no user interaction, and high confidentiality and availability impact.
Likely exposure
Exposure principally concerns Linux systems using ntfs3 to process compressed NTFS data. The bundle identifies relevant 5.15, 6.1, 6.6, 6.11, and 6.12 version lines, but its flattened version data does not establish precise affected ranges. Confirm the running build against vendor guidance and linked stable fixes.
Exploitation context
The attack vector is local and requires low privileges, without user interaction. Exploitation likely requires causing ntfs3 to process malformed compressed NTFS content. The CVE is not listed as KEV, and none of the supplied sources reports exploitation in the wild or demonstrates a reliable privilege-escalation outcome.
Researcher notes
The source describes an oversized LZNT decompression result and an out-of-bounds index in s_max_off. CWE-125 is assigned, while CVSS rates confidentiality and availability impacts high and integrity low. Precise version-range semantics, practical exploit reliability, and privilege-escalation potential are not established by the supplied bundle.
Mitigation direction
- Install a vendor kernel update incorporating the applicable linked stable fix, then reboot into the updated kernel.
- Consult the operating-system vendor for exact affected and fixed package versions.
- Until patched, avoid processing untrusted compressed NTFS volumes with ntfs3.
- Restrict who can introduce or mount untrusted NTFS media or filesystem images.
Validation and detection
- Identify the running kernel version and its distribution package provenance.
- Determine whether ntfs3 is enabled, loaded, or used for mounted NTFS filesystems.
- Compare the running build with vendor guidance and the applicable stable fix commit.
- After updating, confirm the fixed kernel is running, not merely installed.
- Review kernel logs for ntfs3-related faults; absence of faults does not establish non-exposure.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-50247 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H1.85.5LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H1.85.2CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.3HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/e5ae7859008688626b4d2fa6139eeaa08e255053CVE reference, Linux
- https://git.kernel.org/stable/c/1b6bc5f7212181093b6c5310eea216fc09c721a9CVE reference, Linux
- https://git.kernel.org/stable/c/5f21e3e60982cd7353998b4f59f052134fd47d64CVE reference, Linux
- https://git.kernel.org/stable/c/4a4727bc582832f354e0d3d49838a401a28ae25eCVE reference, Linux
- https://git.kernel.org/stable/c/9931122d04c6d431b2c11b5bb7b10f28584067f0CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.