CVE-2024-35827

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-35827
In the Linux kernel, the following vulnerability has been resolved: io_uring/net: fix overflow check in io_recvmsg_mshot_prep() The "controllen" variable is type size_t (unsigned long). Casting it to int could lead to an integer underflow. The check_add_overflow() function considers the type of the destination which is type int. If we add two positive values and the result cannot fit in an integer then that's counted as an overflow. However, if we cast "controllen" to an int and it turns negative, then negative values *can* fit into an int type so there is no overflow. Good: 100 + (unsigned long)-4 = 96 <-- overflow Bad: 100 + (int)-4 = 96 <-- no overflow I deleted the cast of the sizeof() as well. That's not a bug but the cast is unnecessary.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0c8c74bb59e7d77554016efc34c2d10376985e5e Patch
https://git.kernel.org/stable/c/59a534690ecc3af72c6ab121aeac1237a4adae66 Patch
https://git.kernel.org/stable/c/868ec868616438df487b9e2baa5a99f8662cc47c Patch
https://git.kernel.org/stable/c/8ede3db5061bb1fe28e2c9683329aafa89d2b1b4 Patch
https://git.kernel.org/stable/c/b6563ad0d599110bd5cf8f56c47d279c3ed796fe Patch
https://git.kernel.org/stable/c/0c8c74bb59e7d77554016efc34c2d10376985e5e Patch
https://git.kernel.org/stable/c/59a534690ecc3af72c6ab121aeac1237a4adae66 Patch
https://git.kernel.org/stable/c/868ec868616438df487b9e2baa5a99f8662cc47c Patch
https://git.kernel.org/stable/c/8ede3db5061bb1fe28e2c9683329aafa89d2b1b4 Patch
https://git.kernel.org/stable/c/b6563ad0d599110bd5cf8f56c47d279c3ed796fe Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

03 Feb 2025, 16:20

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/0c8c74bb59e7d77554016efc34c2d10376985e5e - () https://git.kernel.org/stable/c/0c8c74bb59e7d77554016efc34c2d10376985e5e - Patch
References () https://git.kernel.org/stable/c/59a534690ecc3af72c6ab121aeac1237a4adae66 - () https://git.kernel.org/stable/c/59a534690ecc3af72c6ab121aeac1237a4adae66 - Patch
References () https://git.kernel.org/stable/c/868ec868616438df487b9e2baa5a99f8662cc47c - () https://git.kernel.org/stable/c/868ec868616438df487b9e2baa5a99f8662cc47c - Patch
References () https://git.kernel.org/stable/c/8ede3db5061bb1fe28e2c9683329aafa89d2b1b4 - () https://git.kernel.org/stable/c/8ede3db5061bb1fe28e2c9683329aafa89d2b1b4 - Patch
References () https://git.kernel.org/stable/c/b6563ad0d599110bd5cf8f56c47d279c3ed796fe - () https://git.kernel.org/stable/c/b6563ad0d599110bd5cf8f56c47d279c3ed796fe - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-190
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

21 Nov 2024, 09:20

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: io_uring/net: corregida la comprobación de desbordamiento en io_recvmsg_mshot_prep() La variable "controllen" es de tipo size_t (largo sin firmar). Convertirlo a int podría provocar un desbordamiento de números enteros. La función check_add_overflow() considera el tipo de destino que es de tipo int. Si sumamos dos valores positivos y el resultado no cabe en un número entero, entonces se cuenta como un desbordamiento. Sin embargo, si convertimos "controllen" en un int y se vuelve negativo, entonces los valores negativos *pueden* caber en un tipo int para que no haya desbordamiento. Bueno: 100 + (unsigned long)-4 = 96 &lt;-- overflow Malo: 100 + (int)-4 = 96 &lt;-- no overflow También eliminé el cast de sizeof(). Eso no es un error, pero el cast es innecesario.
References () https://git.kernel.org/stable/c/0c8c74bb59e7d77554016efc34c2d10376985e5e - () https://git.kernel.org/stable/c/0c8c74bb59e7d77554016efc34c2d10376985e5e -
References () https://git.kernel.org/stable/c/59a534690ecc3af72c6ab121aeac1237a4adae66 - () https://git.kernel.org/stable/c/59a534690ecc3af72c6ab121aeac1237a4adae66 -
References () https://git.kernel.org/stable/c/868ec868616438df487b9e2baa5a99f8662cc47c - () https://git.kernel.org/stable/c/868ec868616438df487b9e2baa5a99f8662cc47c -
References () https://git.kernel.org/stable/c/8ede3db5061bb1fe28e2c9683329aafa89d2b1b4 - () https://git.kernel.org/stable/c/8ede3db5061bb1fe28e2c9683329aafa89d2b1b4 -
References () https://git.kernel.org/stable/c/b6563ad0d599110bd5cf8f56c47d279c3ed796fe - () https://git.kernel.org/stable/c/b6563ad0d599110bd5cf8f56c47d279c3ed796fe -

17 May 2024, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-17 14:15

Updated : 2025-02-03 16:20

NVD link : CVE-2024-35827

Mitre link : CVE-2024-35827

CVE.ORG link : CVE-2024-35827

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-190

Integer Overflow or Wraparound