Security readout for executives and security teams
Plain-English summary
A Linux HFS+ filesystem flaw can cause kernel memory to be accessed outside its intended bounds when a device’s logical block size changes during processing. Successful abuse could crash or corrupt a system and may affect data confidentiality or integrity. Exposure requires local access and specific HFS+ and block-device conditions.
Executive priority
Prioritize affected multi-user, development, virtualization, and file-processing systems where untrusted local workloads can interact with HFS+ or loop devices. Treat remediation as high priority, but below remotely exploitable critical issues unless local access is broadly available or the affected functionality is actively used.
Technical view
The HFS+ driver queried a device’s logical block size more than once. If that size changed between buffer allocation and I/O submission, hfsplus_submit_bio could use a different size, causing an out-of-bounds operation. Testing produced a KASAN slab-use-after-free report in hfsplus_read_wrapper. Stable-kernel commits make the minimum I/O size consistent.
Likely exposure
Likely exposure is limited to Linux systems running versions marked affected, with HFS+ support available and local users or workloads able to mount HFS+ filesystems and manipulate relevant block devices. Internet-facing status alone does not establish exposure. The supplied version mapping is complex, so distribution-specific confirmation is important.
Exploitation context
The CVSS score is 7.8 with local attack vector, low complexity, low privileges, and no user interaction. The source bundle marks the CVE as absent from KEV and provides no evidence of active exploitation, public weaponization, or reliable code execution.
Researcher notes
The supplied evidence demonstrates a kernel memory-safety failure under changing loop-device block sizes. The description discusses a potential out-of-bounds write, while the included KASAN trace reports a slab-use-after-free read. Evidence does not establish reliable privilege escalation or code execution. Validate backports by commit inclusion, not version numbers alone.
Mitigation direction
- Install a vendor-supported kernel update containing the applicable upstream stable fix.
- Consult the Linux distribution’s advisory to confirm the correct fixed package and reboot requirements.
- Until updated, disable unnecessary HFS+ mounting where operationally feasible.
- Restrict untrusted local users from creating or reconfiguring loop devices.
- Reboot into the updated kernel after installation.
Validation and detection
- Inventory running kernel versions, not merely installed kernel packages.
- Determine whether HFS+ support is built, loadable, loaded, or actively mounted.
- Identify workloads using HFS+ filesystems through loop or changeable block devices.
- Confirm the vendor package explicitly addresses CVE-2024-56548 or includes the applicable fix.
- After reboot, verify every host is running the remediated kernel.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-56548 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/baccb5e12577b7a9eff54ffba301fdaa0f3ee5a8CVE reference, Linux
- https://git.kernel.org/stable/c/f57725bcc5816425e25218fdf5fb6923bc578cdfCVE reference, Linux
- https://git.kernel.org/stable/c/e8a2b1c1c2ea85e9a5a2d0c5a5a7e7c639feb866CVE reference, Linux
- https://git.kernel.org/stable/c/06cbfbb13ac88f4154c2eb4bc4176f9d10139847CVE reference, Linux
- https://git.kernel.org/stable/c/3d7bda75e1a6239db053c73acde17ca146317824CVE reference, Linux
- https://git.kernel.org/stable/c/21900e8478126ff6afe3b66679f676e74d1f8830CVE reference, Linux
- https://git.kernel.org/stable/c/2667c9b7b76efcbc7adbfea249892f20c313b0daCVE reference, Linux
- https://git.kernel.org/stable/c/bfeecda050aa9376f642d5b2a71c4112cc6c8216CVE reference, Linux
- https://git.kernel.org/stable/c/1c82587cb57687de3f18ab4b98a8850c789bedcfCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.