CVE-2024-42311

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()

Syzbot reports uninitialized value access issue as below:

loop0: detected capacity change from 0 to 64

=====================================================

BUG: KMSAN: uninit-value in hfs_revalidate_dentry+0x307/0x3f0 fs/hfs/sysdep.c:30

hfs_revalidate_dentry+0x307/0x3f0 fs/hfs/sysdep.c:30

d_revalidate fs/namei.c:862 [inline]

lookup_fast+0x89e/0x8e0 fs/namei.c:1649

walk_component fs/namei.c:2001 [inline]

link_path_walk+0x817/0x1480 fs/namei.c:2332

path_lookupat+0xd9/0x6f0 fs/namei.c:2485

filename_lookup+0x22e/0x740 fs/namei.c:2515

user_path_at_empty+0x8b/0x390 fs/namei.c:2924

user_path_at include/linux/namei.h:57 [inline]

do_mount fs/namespace.c:3689 [inline]

__do_sys_mount fs/namespace.c:3898 [inline]

__se_sys_mount+0x66b/0x810 fs/namespace.c:3875

__x64_sys_mount+0xe4/0x140 fs/namespace.c:3875

do_syscall_x64 arch/x86/entry/common.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References