Linux FUSE CVE-2024-44947: Uninitialized Kernel Memory Leak via fuse_notify_store

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Description: - Vulnerability Name: Linux: fuse_notify_store() marks page uptodate while leaving beyond-EOF parts uninitialized - Description: The interface marks a page as uptodate even when parts beyond the end-of-file (EOF) are uninitialized. This could allow reading uninitialized memory via on systems not configured with init-on-alloc. 2. Impact: - Security Impact: This vulnerability could enable a process to create its own FUSE filesystem and read nearly entirely uninitialized kernel pages (except for the first byte). This is only exploitable on systems not configured with init-on-alloc, which most systems should now use. 3. Fix Status: - Fix Status: The vulnerability has been fixed. - Fix Date: Fixed on August 29, 2024. 4. CVE ID: - CVE Number: CVE-2024-44947 5. Report Date: - Report Date: August 6, 2024 6. Vulnerability Type: - Type: Bug 7. Priority: - Priority: P2 8. Severity: - Severity: S3 9. Reporter: - Reporter: ja...@google.com 10. Fixer: - Fixer: ja...@google.com 11. Verifier: - Verifier: pr...@google.com 12. Discoverer: - Discoverer: jannh 13. Report Date: - Report Date: August 6, 2024 14. Fix Date: - Fix Date: August 29, 2024 15. Deadline: - Deadline: 90 days 16. Over Deadline?: - Over Deadline?: No 17. Methodology: - Methodology: Source code review 18. Product: - Product: Linux 19. Report Date: - Report Date: August 6, 2024 20. Fix Date: - Fix Date: August 29, 2024 21. Need Extension?: - Need Extension?: No 22. Methodology: - Methodology: Source code review 23. Product: - Product: Linux 24. Report Date: - Report Date: August 6, 2024 25. Fix Date: - Fix Date: August 29, 2024 26. Need Extension?: - Need Extension?: No 27. Methodology: - Methodology: Source code review 28. Product: - Product: Linux 29. Report Date: - Report Date: August 6, 2024 30. Fix Date: - Fix Date: August 29, 2024 31. Need Extension?: - Need Extension?: No 32. Methodology: - Methodology: Source code review 33. Product: - Product: Linux 34. Report Date: - Report Date: August 6, 2024 35. Fix Date: - Fix Date: August 29, 2024 36. Need Extension?: - Need Extension?: No 37. Methodology: - Methodology: Source code review 38. Product: - Product: Linux 39. Report Date: - Report Date: August 6, 2024 40. Fix Date: - Fix Date: August 29, 2024 41. Need Extension?: - Need Extension?: No 42. Methodology: - Methodology: Source code review 43. Product: - Product: Linux 44. Report Date: - Report Date: August 6, 2024 45. Fix Date: - Fix Date: August 29, 2024 46. Need Extension?: - Need Extension?: No 47. Methodology: - Methodology: Source code review 48. Product: - Product: Linux 49. Report Date: - Report Date: August 6, 2024 50. Fix Date: - Fix Date: August 29, 2024 51. Need Extension?: - Need Extension?: No 52. Methodology: - Methodology: Source code review 53. Product: - Product: Linux 54. Report Date: - Report Date: August 6, 2024 55. Fix Date: - Fix Date: August 29, 2024 56. Need Extension?: - Need Extension?: No 57. Methodology: - Methodology: Source code review 58. Product: - Product: Linux 59. Report Date: - Report Date: August 6, 2024 60. Fix Date: - Fix Date: August 29, 2024 61. Need Extension?: - Need Extension?: No 62. Methodology: - Methodology: Source code review 63. Product: - Product: Linux 64. Report Date: - Report Date: August 6, 2024 65. Fix Date: - Fix Date: August 29, 2024 66. Need Extension?: - Need Extension?: No 67. Methodology: - Methodology: Source code review 68. Product: - Product: Linux 69. Report Date: - Report Date: August 6, 2024 70. Fix Date: - Fix Date: August 29, 2024 71. Need Extension?: - Need Extension?: No 72. Methodology: - Methodology: Source code review 73. Product: - Product: Linux 74. Report Date: - Report Date: August 6, 2024 75. Fix Date: - Fix Date: August 29, 2024 76. Need Extension?: - Need Extension?: No 77. Methodology: - Methodology: Source code review 78. Product: - Product: Linux 79. Report Date: - Report Date: August 6, 2024 80. Fix Date: - Fix Date: August 29, 2024 81. Need Extension?: - Need Extension?: No 82. Methodology: - Methodology: Source code review 83. Product: - Product: Linux 84. Report Date: - Report Date: August 6, 2024 85. Fix Date: - Fix Date: August 29, 2024 86. Need Extension?: - Need Extension?: No 87. Methodology: - Methodology: Source code review 88. Product: - Product: Linux 89. Report Date: - Report Date: August 6, 2024 90. Fix Date: - Fix Date: August 29, 2024 91. Need Extension?: - Need Extension?: No

Goal Reached Thanks to every supporter — we hit 100%!

Linux FUSE CVE-2024-44947: Uninitialized Kernel Memory Leak via fuse_notify_store