Detections
Analytics
Bottlerocket: bottlerocket-kernel-6.1, kernel-6.1: security update to 6.1.124
high Tenable Cloud Security Plugin ID 428086
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- In the Linux kernel, the following vulnerability has been resolved: xfs: add bounds checking to
xlog_recover_process_data There is a lack of verification of the space occupied by fixed members of
xlog_op_header in the xlog_recover_process_data. We can create a crafted image to trigger an out of bounds
read by following these steps: 1) Mount an image of xfs, and do some file operations to leave records 2)
Before umounting, copy the image for subsequent steps to simulate abnormal exit. Because umount will
ensure that tail_blk and head_blk are the same, which will result in the inability to enter
xlog_recover_process_data 3) Write a tool to parse and modify the copied image in step 2 4) Make the end
of the xlog_op_header entries only 1 byte away from xlog_rec_header->h_size 5)
xlog_rec_header->h_num_logops++ 6) Modify xlog_rec_header->h_crc Fix: Add a check to make sure there is
sufficient space to access fixed members of xlog_op_header. (CVE-2024-41014)
Plugin Details
Severity: High
ID: 428086
Version: Revision 1.4
Type: Local
Published: 6/30/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.3
Percentile: 53.18
CVSS v2
Risk Factor: Medium
Base Score: 6.2
Temporal Score: 4.6
Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C
CVSS Score Source: CVE-2024-41014
CVSS v3
Risk Factor: High
Base Score: 7.1
Temporal Score: 6.2
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 7/29/2024
Reference Information
CVE: CVE-2024-41014