CVE-2024-26828
cifs: fix underflow in parse_server_interfaces()
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
In the Linux kernel, the following vulnerability has been resolved:
cifs: fix underflow in parse_server_interfaces()
In this loop, we step through the buffer and after each item we check
if the size_left is greater than the minimum size we need. However,
the problem is that "bytes_left" is type ssize_t while sizeof() is type
size_t. That means that because of type promotion, the comparison is
done as an unsigned and if we have negative bytes left the loop
continues instead of ending.
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: cifs: corrige el desbordamiento insuficiente en parse_server_interfaces() En este bucle, recorremos el búfer y después de cada elemento comprobamos si size_left es mayor que el tamaño mínimo que necesitamos. Sin embargo, el problema es que "bytes_left" es del tipo ssize_t mientras que sizeof() es del tipo size_t. Eso significa que debido a la promoción de tipo, la comparación se realiza sin firmar y si nos quedan bytes negativos, el ciclo continúa en lugar de finalizar.
CVSS Scores
SSVC
- Decision:Track
Timeline
- 2024-02-19 CVE Reserved
- 2024-04-17 CVE Published
- 2024-04-18 EPSS Updated
- 2024-08-02 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-191: Integer Underflow (Wrap or Wraparound)
CAPEC
References (7)
| URL | Tag | Source |
|---|---|---|
| https://git.kernel.org/stable/c/fe856be475f7cf5ffcde57341d175ce9fd09434b | Vuln. Introduced |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2024-26828 | 2024-08-15 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2275600 | 2024-08-15 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.18 < 6.1.79 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.18 < 6.1.79" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.18 < 6.6.18 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.18 < 6.6.18" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.18 < 6.7.6 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.18 < 6.7.6" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.18 < 6.8 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.18 < 6.8" | en |
Affected
| ||||||