CVE-2024-36957

octeontx2-af: avoid off-by-one read from userspace

Severity Score

4.4

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

In the Linux kernel, the following vulnerability has been resolved:

octeontx2-af: avoid off-by-one read from userspace

We try to access count + 1 byte from userspace with memdup_user(buffer,
count + 1). However, the userspace only provides buffer of count bytes and
only these count bytes are verified to be okay to access. To ensure the
copied buffer is NUL terminated, we use memdup_user_nul instead.

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: octeontx2-af: evitar lecturas uno por uno desde el espacio de usuario Intentamos acceder al recuento + 1 byte desde el espacio de usuario con memdup_user (búfer, recuento + 1). Sin embargo, el espacio de usuario solo proporciona un búfer de bytes de recuento y solo se verifica que se puede acceder a estos bytes de recuento. Para garantizar que el búfer copiado tenga terminación NUL, usamos memdup_user_nul en su lugar.

*Credits: N/A

CVSS Scores

Red Hatv3.1 4.4

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-05-30 CVE Reserved
2024-05-30 CVE Published
2024-05-31 EPSS Updated
2024-08-02 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-193: Off-by-one Error

CAPEC

References (12)

URL	Tag	Source
https://git.kernel.org/stable/c/dae49384d0d7695540e2d75168f323cef1384810	Vuln. Introduced
https://git.kernel.org/stable/c/3a2eb515d1367c0f667b76089a6e727279c688b8	Vuln. Introduced
https://git.kernel.org/stable/c/c9a2ed3fdd037314a71e6a6ba5d99a3605f6f9c7	Vuln. Introduced
https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html

URL	Date	SRC

URL	Date	SRC
https://git.kernel.org/stable/c/bcdac70adceb44373da204c3c297f2a98e13216e	2024-05-17
https://git.kernel.org/stable/c/ec697fbd38cbe2eef0948b58673b146caa95402f	2024-05-17
https://git.kernel.org/stable/c/8f11fe3ea3fc261640cfc8a5addd838000407c67	2024-05-17
https://git.kernel.org/stable/c/0a0285cee11c7dcc2657bcd456e469958a5009e7	2024-05-17
https://git.kernel.org/stable/c/fc3e0076c1f82fe981d321e3a7bad4cbee542c19	2024-05-17
https://git.kernel.org/stable/c/f299ee709fb45036454ca11e90cb2810fe771878	2024-04-26

URL	Date	SRC
https://access.redhat.com/security/cve/CVE-2024-36957	2024-07-17
https://bugzilla.redhat.com/show_bug.cgi?id=2284581	2024-07-17

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 5.10.20 < 5.10.217 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.10.20 < 5.10.217"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 5.12 < 5.15.159 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.12 < 5.15.159"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 5.12 < 6.1.91 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.12 < 6.1.91"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 5.12 < 6.6.31 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.12 < 6.6.31"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 5.12 < 6.8.10 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.12 < 6.8.10"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 5.12 < 6.9 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.12 < 6.9"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				5.11.3 Search vendor "Linux" for product "Linux Kernel" and version "5.11.3"		en		Affected