VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Nov 25, 2024· Updated May 12, 2026

CVE-2024-53101

CVE-2024-53101

Description

In the Linux kernel, the following vulnerability has been resolved:

fs: Fix uninitialized value issue in from_kuid and from_kgid

ocfs2_setattr() uses attr->ia_mode, attr->ia_uid and attr->ia_gid in a trace point even though ATTR_MODE, ATTR_UID and ATTR_GID aren't set.

Initialize all fields of newattrs to avoid uninitialized variables, by checking if ATTR_MODE, ATTR_UID, ATTR_GID are initialized, otherwise 0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Uninitialized variables in ocfs2_setattr() tracepoint could leak kernel memory or cause info disclosure via from_kuid/from_kgid.

Vulnerability

In the Linux kernel, ocfs2_setattr() uses attr->ia_mode, attr->ia_uid, and attr->ia_gid in a tracepoint even when the corresponding ATTR_MODE, ATTR_UID, and ATTR_GID flags are not set. This leads to uninitialized kernel stack values being used in from_kuid and from_kgid conversions, potentially leaking sensitive information.

Exploitation

The vulnerability is triggered locally by a user with the ability to perform attribute changes on an OCFS2 filesystem. No special privileges are required beyond local access. The attack surface is limited to systems using the OCFS2 filesystem, which is common in clustering environments.

Impact

An attacker could observe the uninitialized kernel memory via the tracepoint output, leading to information disclosure. The CVSS score is 5.5 (Medium) with confidentiality impact only, as per the official description.

Mitigation

The fix initializes all fields of newattrs to zero before use, and checks that ATTR_MODE, ATTR_UID, and ATTR_GID are set before accessing them. The patch is available in the stable kernel tree. Users should update their kernels to include the fix.

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

113

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

12

News mentions

0

No linked articles in our index yet.