What is the CVSS score of CVE-2024-27407?

CVE-2024-27407 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Linux Kernel are affected by CVE-2024-27407?

Linux kernel NTFS3 filesystem driver contains a buffer overflow vulnerability (CVE-2024-27407, CVSS 7.8) that enables memory corruption when systems process maliciously crafted NTFS attributes.. A patch is available.

How to fix or mitigate CVE-2024-27407?

Within 24 hours, inventory all Linux systems running kernel versions through 6.8-rc3 with NTFS3 driver enabled to determine organizational exposure and identify critical systems requiring priority patching. Within 7 days, deploy the available vendor patch to all production systems, beginning with those supporting business-critical workloads. Within 30 days, complete patch deployment across remaining systems, validate kernel functionality in staging environments post-upgrade, and review system logs for any exploitation indicators during the transition window.

Linux Kernel CVE-2024-27407

HIGH

Classic Buffer Overflow (CWE-120)

2024-05-17 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Buffer Overflow Linux

7.8

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local filesystem flaw requiring user to mount crafted image; PR:N reflects unprivileged automount capability common on desktop Linux; UI:R confirmed by mount requirement.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 12:46 vuln.today

v3 (cvss_changed)

Analysis Updated

Aug 04, 2026 - 12:44 vuln.today

v2 (cvss_changed)

Analysis Updated

Aug 04, 2026 - 12:43 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 11:23 vuln.today

cvss_changed

CVSS changed

Aug 04, 2026 - 11:23 NVD

8.4 (HIGH) 7.8 (HIGH)

CVE Published

May 17, 2024 - 12:15 cve.org

HIGH 8.4

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Fixed overflow check in mi_enum_attr()

AnalysisAI

Buffer overflow in the Linux kernel's NTFS3 filesystem driver exposes systems to high-impact memory corruption when parsing maliciously crafted NTFS attributes. The flaw resides in mi_enum_attr(), the function responsible for iterating MFT (Master File Table) record attributes, and affects kernel versions spanning multiple stable branches through 6.8-rc3. CVSS rates the impact at 7.8 (High) across confidentiality, integrity, and availability, though the EPSS score of 0.29% (21st percentile) and absence from CISA KEV indicate no public exploit identified at time of analysis and minimal observed exploitation activity.

Technical ContextAI

NTFS3 is a native in-kernel Linux driver for the NTFS filesystem, introduced as a modern replacement for the legacy ntfs driver and the FUSE-based ntfs-3g. The vulnerable function mi_enum_attr() in fs/ntfs3/ iterates over attribute entries within NTFS MFT records. CWE-120 (Buffer Copy without Checking Size of Input) identifies the root cause: the function's overflow guard was either missing or logically incorrect when computing attribute boundaries, creating conditions for out-of-bounds memory access when processing specially constructed MFT attribute data. CPE data (cpe:2.3:o:linux:linux_kernel) confirms impact across multiple stable kernel series and the 6.8-rc1 through rc3 release candidates, with four distinct stable-branch backport commits (1c0a95d, 652cfeb, 8c77398, e99faa9) indicating broad version range affected.

RemediationAI

The primary fix is to update to a patched Linux kernel version containing upstream commits 1c0a95d99b1b2b5d842e5abc7ef7eed1193b60d7, 652cfeb43d6b9aba5c7c4902bed7a7340df131fb, 8c77398c72618101d66480b94b34fe9087ee3d08, or e99faa97359654b6e4e769246c72cf50a57e05b2, available via the stable kernel tree at https://git.kernel.org/stable/. Patch available per vendor advisory; distributed kernel packages from major distributions should be applied via standard update mechanisms (apt, dnf, zypper). Debian LTS users should apply the update announced at https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html. Where immediate patching is not possible, a targeted compensating control is to blacklist the ntfs3 kernel module (echo 'blacklist ntfs3' >> /etc/modprobe.d/disable-ntfs3.conf followed by update-initramfs -u), which prevents the vulnerable code path from loading entirely; the trade-off is loss of in-kernel NTFS read/write support, though ntfs-3g via FUSE remains available as an alternative. Additionally, restricting unprivileged user mount capabilities via /etc/fstab or mount namespace policies reduces the UI:R attack surface on multi-user systems.