Security readout for executives and security teams
Plain-English summary
A Linux ntfs3 filesystem bug could let a local, low-privileged attacker trigger access beyond valid kernel memory. Potential consequences include sensitive-memory exposure or system disruption. Risk mainly concerns systems running affected kernels where users can cause NTFS data to be processed.
Executive priority
Prioritize affected multi-user systems, shared infrastructure, and endpoints that process removable or externally supplied NTFS media. Schedule prompt kernel remediation through normal emergency-patching controls. Immediate crisis response is not supported by the supplied evidence because active exploitation is unconfirmed and the attack vector is local.
Technical view
The ntfs3 mi_enum_attr() routine lacked sufficient bounds checking, allowing an attribute to extend beyond its valid memory region. The supplied CVSS 3.1 score is 7.1, with local access, low privileges, no user interaction, and potentially high confidentiality and availability impact. Referenced stable-kernel commits add the missing checks.
Likely exposure
Potentially exposed systems run an affected Linux kernel and use ntfs3, particularly where low-privileged users can introduce, mount, or otherwise cause NTFS filesystems to be processed. The supplied version data includes 5.15, 6.1.120, 6.6.60, 6.11.7, and 6.12, but its exact range semantics are incomplete.
Exploitation context
The supplied record is not marked as CISA KEV, and no cited source states that exploitation is active. The CVSS vector indicates a local, low-privileged attack requiring no user interaction. The bundle does not describe the precise trigger, exploit reliability, or public proof-of-concept availability.
Researcher notes
The record identifies a bounds-checking failure in mi_enum_attr() and provides four stable-kernel fix commits. The supplied affected-version representation is ambiguous and should not be treated as a complete vulnerable-range map. Validate exposure against distribution advisories and commit backports. No CWE, detailed trigger analysis, or confirmed exploitation evidence is supplied.
Mitigation direction
- Apply a vendor kernel update incorporating the referenced stable fixes.
- Reboot systems into the updated kernel after installation.
- Until patched, restrict low-privileged access to untrusted NTFS filesystems where operationally feasible.
- Check distribution advisories for package-specific remediation and backport details.
Validation and detection
- Record the running kernel and distribution package versions.
- Determine whether ntfs3 is enabled and used on affected systems.
- Confirm the installed kernel contains the applicable referenced stable fix or vendor backport.
- After rebooting, verify the updated kernel is running.
- Review logs for ntfs3-related kernel faults, while recognizing absence does not prove safety.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-50248 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2LinuxVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/386613a44b858304a88529ade2ccc1e079a5fc56CVE reference, Linux
- https://git.kernel.org/stable/c/22cdf3be7d34f61a91b9e2966fec3a29f3871398CVE reference, Linux
- https://git.kernel.org/stable/c/809f9b419c75f8042c58434d2bfe849140643e9dCVE reference, Linux
- https://git.kernel.org/stable/c/556bdf27c2dd5c74a9caacbe524b943a6cd42d99CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.