CVE-2024-38623

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: The issue is related to the allocation of insufficient memory in the GUID structure of the fs/ntfs3 module in the Linux kernel. This could allow a remote attacker to impact the confidentiality, integrity, and availability of protected information. The problem arises from the use of a fixed-size array instead of a variable-length array, which leads to a smatch warning in the ntfs set label() function. Specifically, the uni->name variable is too small, with a size of 20 compared to the required 256.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.