Riskcovery

CVE-2024-53101

fs: Fix uninitialized value issue in from_kuid and from_kgid

State
Published
Severity
5.5 Medium
Published
Nov 25, 2024
Updated
Oct 15, 2026
Reserved
Nov 19, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

fs: Fix uninitialized value issue in from_kuid and from_kgid

ocfs2_setattr() uses attr->ia_mode, attr->ia_uid and attr->ia_gid in a trace point even though ATTR_MODE, ATTR_UID and ATTR_GID aren't set.

Initialize all fields of newattrs to avoid uninitialized variables, by checking if ATTR_MODE, ATTR_UID, ATTR_GID are initialized, otherwise 0.

Scores

CVSSScoreVectorSource
3.15.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCISA-ADP

Weaknesses

  • CWE-908 Use of Uninitialized Resource

Affected Products

ProductVersions
LinuxLinux
  • 468eedde23d6c9335935773f4f5764267d5a7763 to before a0c77e5e3dcbffc7c6080ccc89c037f0c86496cfAffected
  • 468eedde23d6c9335935773f4f5764267d5a7763 to before 17ecb40c5cc7755a321fb6148cba5797431ee5b8Affected
  • 468eedde23d6c9335935773f4f5764267d5a7763 to before 9db25c2b41c34963c3ccf473b08171f87670652eAffected
  • 468eedde23d6c9335935773f4f5764267d5a7763 to before b3e612bd8f64ce62e731e95f635e06a2efe3c80cAffected
  • 468eedde23d6c9335935773f4f5764267d5a7763 to before 5a72b0d3497b818d8f000c347a7c11801eb27bfcAffected
  • 468eedde23d6c9335935773f4f5764267d5a7763 to before 1cb5bfc5bfc651982b6203c224d49b7ddacf28bcAffected
  • 468eedde23d6c9335935773f4f5764267d5a7763 to before 1c28bca1256aecece6e94b26b85cd07e08b0dc90Affected
  • 468eedde23d6c9335935773f4f5764267d5a7763 to before 15f34347481648a567db67fb473c23befb796af5Affected
LinuxLinux
  • 2.6.39Affected
  • before 2.6.39Not affected
  • 4.19.324 through 4.19.*Not affected
  • 5.4.286 through 5.4.*Not affected
  • 5.10.230 through 5.10.*Not affected
  • 5.15.173 through 5.15.*Not affected
  • 6.1.118 through 6.1.*Not affected
  • 6.6.62 through 6.6.*Not affected
  • 6.11.9 through 6.11.*Not affected
  • 6.12 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.