CVE-2024-50143

udf: fix uninit-value use in udf_get_fileshortad

Severity Score

"-"

*CVSS v-

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

In the Linux kernel, the following vulnerability has been resolved:

udf: fix uninit-value use in udf_get_fileshortad

Check for overflow when computing alen in udf_current_aext to mitigate
later uninit-value use in udf_get_fileshortad KMSAN bug[1].
After applying the patch reproducer did not trigger any issue[2].

[1] https://syzkaller.appspot.com/bug?extid=8901c4560b7ab5c2f9df
[2] https://syzkaller.appspot.com/x/log.txt?x=10242227980000

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: udf: se corrige el uso de un valor no inicializado en udf_get_fileshortad. Se comprueba si hay desbordamiento al calcular alen en udf_current_aext para mitigar el uso posterior de un valor no inicializado en udf_get_fileshortad. Error de KMSAN[1]. Después de aplicar el parche, el reproductor no activó ningún problema[2]. [1] https://syzkaller.appspot.com/bug?extid=8901c4560b7ab5c2f9df [2] https://syzkaller.appspot.com/x/log.txt?x=10242227980000

*Credits: N/A

CVSS Scores

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2024-10-21 CVE Reserved
2024-11-07 CVE Published
2024-11-16 EPSS Updated
2024-11-19 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CAPEC

References (7)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC
https://git.kernel.org/stable/c/5eb76fb98b3335aa5cca6a7db2e659561c79c32b	2024-11-08
https://git.kernel.org/stable/c/417bd613bdbe791549f7687bb1b9b8012ff111c2	2024-11-08
https://git.kernel.org/stable/c/4fc0d8660e391dcd8dde23c44d702be1f6846c61	2024-11-01
https://git.kernel.org/stable/c/72e445df65a0aa9066c6fe2b8736ba2fcca6dac7	2024-11-01
https://git.kernel.org/stable/c/1ac49babc952f48d82676979b20885e480e69be8	2024-11-01
https://git.kernel.org/stable/c/e52e0b92ed31dc62afbda15c243dcee0bb5bb58d	2024-11-01
https://git.kernel.org/stable/c/264db9d666ad9a35075cc9ed9ec09d021580fbb1	2024-10-02

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 4.19.323 Search vendor "Linux" for product "Linux Kernel" and version " < 4.19.323"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 5.4.285 Search vendor "Linux" for product "Linux Kernel" and version " < 5.4.285"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 5.15.170 Search vendor "Linux" for product "Linux Kernel" and version " < 5.15.170"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 6.1.115 Search vendor "Linux" for product "Linux Kernel" and version " < 6.1.115"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 6.6.59 Search vendor "Linux" for product "Linux Kernel" and version " < 6.6.59"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 6.11.6 Search vendor "Linux" for product "Linux Kernel" and version " < 6.11.6"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 6.12 Search vendor "Linux" for product "Linux Kernel" and version " < 6.12"		en		Affected