CVE-2024-35849

CVE-2024-35849 is an information leak vulnerability in the Linux kernel's Btrfs filesystem, specifically affecting the btrfs_ioctl_logical_to_ino() function. This flaw allows an attacker to read uninitialized kernel memory due to the use of kvmalloc() instead of kvzalloc() for memory allocation, which does not zero-fill the memory. It impacts various Linux distributions, including Debian. Rated as High severity with a CVSS score of 7.1, this vulnerability has a local attack vector and low attack complexity. A successful exploit could lead to a high impact on confidentiality, allowing an authenticated local attacker to potentially gain sensitive information from kernel memory. There is no impact on integrity or availability. Currently, there is no evidence of active exploitation, nor is exploit code publicly available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, indicating a low level of public attention.