CVE-2024-26973

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-26973
In the Linux kernel, the following vulnerability has been resolved: fat: fix uninitialized field in nostale filehandles When fat_encode_fh_nostale() encodes file handle without a parent it stores only first 10 bytes of the file handle. However the length of the file handle must be a multiple of 4 so the file handle is actually 12 bytes long and the last two bytes remain uninitialized. This is not great at we potentially leak uninitialized information with the handle to userspace. Properly initialize the full handle length.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/03a7e3f2ba3ca25f1da1d3898709a08db14c1abb Mailing List Patch
https://git.kernel.org/stable/c/74f852654b8b7866f15323685f1e178d3386c688 Mailing List Patch
https://git.kernel.org/stable/c/9840d1897e28f8733cc1e38f97e044f987dc0a63 Mailing List Patch
https://git.kernel.org/stable/c/a276c595c3a629170b0f052a3724f755d7c6adc6 Mailing List Patch
https://git.kernel.org/stable/c/b7fb63e807c6dadf7ecc1d43448c4f1711d7eeee Mailing List Patch
https://git.kernel.org/stable/c/c8cc05de8e6b5612b6e9f92c385c1a064b0db375 Mailing List Patch
https://git.kernel.org/stable/c/cdd33d54e789d229d6d5007cbf3f53965ca1a5c6 Mailing List Patch
https://git.kernel.org/stable/c/f52d7663a10a1266a2d3871a6dd8fd111edc549f Mailing List Patch
https://git.kernel.org/stable/c/fde2497d2bc3a063d8af88b258dbadc86bd7b57c Mailing List Patch
https://git.kernel.org/stable/c/03a7e3f2ba3ca25f1da1d3898709a08db14c1abb Mailing List Patch
https://git.kernel.org/stable/c/74f852654b8b7866f15323685f1e178d3386c688 Mailing List Patch
https://git.kernel.org/stable/c/9840d1897e28f8733cc1e38f97e044f987dc0a63 Mailing List Patch
https://git.kernel.org/stable/c/a276c595c3a629170b0f052a3724f755d7c6adc6 Mailing List Patch
https://git.kernel.org/stable/c/b7fb63e807c6dadf7ecc1d43448c4f1711d7eeee Mailing List Patch
https://git.kernel.org/stable/c/c8cc05de8e6b5612b6e9f92c385c1a064b0db375 Mailing List Patch
https://git.kernel.org/stable/c/cdd33d54e789d229d6d5007cbf3f53965ca1a5c6 Mailing List Patch
https://git.kernel.org/stable/c/f52d7663a10a1266a2d3871a6dd8fd111edc549f Mailing List Patch
https://git.kernel.org/stable/c/fde2497d2bc3a063d8af88b258dbadc86bd7b57c Mailing List Patch
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html Mailing List
https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html Mailing List
https://cert-portal.siemens.com/productcert/html/ssa-265688.html
https://cert-portal.siemens.com/productcert/html/ssa-398330.html
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
History

12 May 2026, 12:16

Type Values Removed Values Added
CWE CWE-908
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux linux Kernel
Debian debian Linux
Debian
Linux
References
  • () https://cert-portal.siemens.com/productcert/html/ssa-265688.html -
  • () https://cert-portal.siemens.com/productcert/html/ssa-398330.html -
References () https://git.kernel.org/stable/c/03a7e3f2ba3ca25f1da1d3898709a08db14c1abb - () https://git.kernel.org/stable/c/03a7e3f2ba3ca25f1da1d3898709a08db14c1abb - Mailing List, Patch
References () https://git.kernel.org/stable/c/74f852654b8b7866f15323685f1e178d3386c688 - () https://git.kernel.org/stable/c/74f852654b8b7866f15323685f1e178d3386c688 - Mailing List, Patch
References () https://git.kernel.org/stable/c/9840d1897e28f8733cc1e38f97e044f987dc0a63 - () https://git.kernel.org/stable/c/9840d1897e28f8733cc1e38f97e044f987dc0a63 - Mailing List, Patch
References () https://git.kernel.org/stable/c/a276c595c3a629170b0f052a3724f755d7c6adc6 - () https://git.kernel.org/stable/c/a276c595c3a629170b0f052a3724f755d7c6adc6 - Mailing List, Patch
References () https://git.kernel.org/stable/c/b7fb63e807c6dadf7ecc1d43448c4f1711d7eeee - () https://git.kernel.org/stable/c/b7fb63e807c6dadf7ecc1d43448c4f1711d7eeee - Mailing List, Patch
References () https://git.kernel.org/stable/c/c8cc05de8e6b5612b6e9f92c385c1a064b0db375 - () https://git.kernel.org/stable/c/c8cc05de8e6b5612b6e9f92c385c1a064b0db375 - Mailing List, Patch
References () https://git.kernel.org/stable/c/cdd33d54e789d229d6d5007cbf3f53965ca1a5c6 - () https://git.kernel.org/stable/c/cdd33d54e789d229d6d5007cbf3f53965ca1a5c6 - Mailing List, Patch
References () https://git.kernel.org/stable/c/f52d7663a10a1266a2d3871a6dd8fd111edc549f - () https://git.kernel.org/stable/c/f52d7663a10a1266a2d3871a6dd8fd111edc549f - Mailing List, Patch
References () https://git.kernel.org/stable/c/fde2497d2bc3a063d8af88b258dbadc86bd7b57c - () https://git.kernel.org/stable/c/fde2497d2bc3a063d8af88b258dbadc86bd7b57c - Mailing List, Patch
References () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html - () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html - Mailing List
References () https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html - () https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html - Mailing List
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

21 Nov 2024, 09:03

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html -
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html -
References () https://git.kernel.org/stable/c/03a7e3f2ba3ca25f1da1d3898709a08db14c1abb - () https://git.kernel.org/stable/c/03a7e3f2ba3ca25f1da1d3898709a08db14c1abb -
References () https://git.kernel.org/stable/c/74f852654b8b7866f15323685f1e178d3386c688 - () https://git.kernel.org/stable/c/74f852654b8b7866f15323685f1e178d3386c688 -
References () https://git.kernel.org/stable/c/9840d1897e28f8733cc1e38f97e044f987dc0a63 - () https://git.kernel.org/stable/c/9840d1897e28f8733cc1e38f97e044f987dc0a63 -
References () https://git.kernel.org/stable/c/a276c595c3a629170b0f052a3724f755d7c6adc6 - () https://git.kernel.org/stable/c/a276c595c3a629170b0f052a3724f755d7c6adc6 -
References () https://git.kernel.org/stable/c/b7fb63e807c6dadf7ecc1d43448c4f1711d7eeee - () https://git.kernel.org/stable/c/b7fb63e807c6dadf7ecc1d43448c4f1711d7eeee -
References () https://git.kernel.org/stable/c/c8cc05de8e6b5612b6e9f92c385c1a064b0db375 - () https://git.kernel.org/stable/c/c8cc05de8e6b5612b6e9f92c385c1a064b0db375 -
References () https://git.kernel.org/stable/c/cdd33d54e789d229d6d5007cbf3f53965ca1a5c6 - () https://git.kernel.org/stable/c/cdd33d54e789d229d6d5007cbf3f53965ca1a5c6 -
References () https://git.kernel.org/stable/c/f52d7663a10a1266a2d3871a6dd8fd111edc549f - () https://git.kernel.org/stable/c/f52d7663a10a1266a2d3871a6dd8fd111edc549f -
References () https://git.kernel.org/stable/c/fde2497d2bc3a063d8af88b258dbadc86bd7b57c - () https://git.kernel.org/stable/c/fde2497d2bc3a063d8af88b258dbadc86bd7b57c -

05 Nov 2024, 10:16

Type Values Removed Values Added
References
  • {'url': 'https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}
  • {'url': 'https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}

27 Jun 2024, 12:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html -

25 Jun 2024, 22:15

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: fat: corrige el campo no inicializado en los identificadores de archivos notale Cuando fat_encode_fh_nostale() codifica el identificador de archivo sin un padre, almacena solo los primeros 10 bytes del identificador de archivo. Sin embargo, la longitud del identificador del archivo debe ser múltiplo de 4, por lo que el identificador del archivo tiene en realidad 12 bytes de longitud y los dos últimos bytes permanecen sin inicializar. Esto no es bueno porque potencialmente filtramos información no inicializada con el identificador al espacio de usuario. Inicialice correctamente toda la longitud del mango.
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html -

01 May 2024, 06:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-01 06:15

Updated : 2026-05-12 12:16

NVD link : CVE-2024-26973

Mitre link : CVE-2024-26973

CVE.ORG link : CVE-2024-26973

JSON object : View

Products Affected

debian

  • debian_linux

linux

  • linux_kernel
CWE
CWE-908

Use of Uninitialized Resource