CVE-2024-42315

5.5 · MEDIUM

Published Aug 17, 2024 linux CWE-667 EPSS 0.17% (6th pctl) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Overview

CVE-2024-42315 is a medium-severity vulnerability affecting linux linux_kernel. It was published on August 17, 2024 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

exfat: fix potential deadlock on __exfat_get_dentry_set

When accessing a file with more entries than ES_MAX_ENTRY_NUM, the bh-array

is allocated in __exfat_get_entry_set. The problem is that the bh-array is

allocated with GFP_KERNEL. It does not make sense. In the following cases,

a deadlock for sbi->s_lock between the two processes may occur.

CPU0 CPU1

---- ----

kswapd

balance_pgdat

lock(fs_reclaim)

exfat_iterate

lock(&sbi->s_lock)

exfat_readdir

exfat_get_uniname_from_ext_entry

exfat_get_dentry_set

__exfat_get_dentry_set

kmalloc_array

...

lock(fs_reclaim)

...

evict

exfat_evict_inode

lock(&sbi->s_lock)

To fix this, let's a

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

Vendor	Product	Versions	Status
linux	linux_kernel	>= 6.2, < 6.6.44	Affected

References

Ref git.kernel.org/stable/c/1d1970493c289e3f44b9ec847ed26a5dbdf56a62 Ref git.kernel.org/stable/c/632fb232b6bbf8277edcbe9ecd4b4d98ecb122eb Ref git.kernel.org/stable/c/89fc548767a2155231128cb98726d6d2ea1256c9 Ref git.kernel.org/stable/c/a7ac198f8dba791e3144c4da48a5a9b95773ee4b Ref git.kernel.org/stable/c/c052f775ee6ccacd3c97e4cf41a2a657e63d4259 Ref git.kernel.org/stable/c/cd1c7858641384191ff7033fb1fc65dfcd559c6f Ref lists.debian.org/debian-lts-announce/2025/03/msg00001.html Ref lists.debian.org/debian-lts-announce/2025/03/msg00002.html

Frequently Asked Questions

What is CVE-2024-42315?

CVE-2024-42315 is a medium-severity vulnerability affecting linux linux_kernel. It was published on August 17, 2024 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2024-42315?

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2024-42315?

How can CyberStrike help with CVE-2024-42315?

CyberStrike's AI-powered security agents can automatically detect CVE-2024-42315 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.

How CyberStrike Helps

Autonomous Discovery

AI agents map your attack surface to find vulnerabilities like this one.

Continuous Pentesting

Automated penetration testing that runs continuously, not just quarterly.

Code Review

AI-driven PR review catches vulnerable dependencies before they ship.

HackBrowser

Browser-based exploitation validates findings with real proof-of-concept.

Related MEDIUM CVEs from 2024

View all →

6.9

CVE-2023-3726

OCSInventory allow stored email template with special characters that lead to a Stored cross-site Sc

6.9

CVE-2023-51719