CVE-2024-36025

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-36025
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() The app_reply->elem[] array is allocated earlier in this function and it has app_req.num_ports elements. Thus this > comparison needs to be >= to prevent memory corruption.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/4406e4176f47177f5e51b4cc7e6a7a2ff3dbfbbd Patch
https://git.kernel.org/stable/c/60b87b5ecbe07d70897d35947b0bb3e76ccd1b3a Patch
https://git.kernel.org/stable/c/8c820f7c8e9b46238d277c575392fe9930207aab Patch
https://git.kernel.org/stable/c/9fc74e367be4247a5ac39bb8ec41eaa73fade510 Patch
https://git.kernel.org/stable/c/ea8ac95c22c93acecb710209a7fd10b851afe817 Patch
https://git.kernel.org/stable/c/4406e4176f47177f5e51b4cc7e6a7a2ff3dbfbbd Patch
https://git.kernel.org/stable/c/60b87b5ecbe07d70897d35947b0bb3e76ccd1b3a Patch
https://git.kernel.org/stable/c/8c820f7c8e9b46238d277c575392fe9930207aab Patch
https://git.kernel.org/stable/c/9fc74e367be4247a5ac39bb8ec41eaa73fade510 Patch
https://git.kernel.org/stable/c/ea8ac95c22c93acecb710209a7fd10b851afe817 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
History

18 Sep 2025, 14:07

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
First Time Linux linux Kernel
Linux
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-193
References () https://git.kernel.org/stable/c/4406e4176f47177f5e51b4cc7e6a7a2ff3dbfbbd - () https://git.kernel.org/stable/c/4406e4176f47177f5e51b4cc7e6a7a2ff3dbfbbd - Patch
References () https://git.kernel.org/stable/c/60b87b5ecbe07d70897d35947b0bb3e76ccd1b3a - () https://git.kernel.org/stable/c/60b87b5ecbe07d70897d35947b0bb3e76ccd1b3a - Patch
References () https://git.kernel.org/stable/c/8c820f7c8e9b46238d277c575392fe9930207aab - () https://git.kernel.org/stable/c/8c820f7c8e9b46238d277c575392fe9930207aab - Patch
References () https://git.kernel.org/stable/c/9fc74e367be4247a5ac39bb8ec41eaa73fade510 - () https://git.kernel.org/stable/c/9fc74e367be4247a5ac39bb8ec41eaa73fade510 - Patch
References () https://git.kernel.org/stable/c/ea8ac95c22c93acecb710209a7fd10b851afe817 - () https://git.kernel.org/stable/c/ea8ac95c22c93acecb710209a7fd10b851afe817 - Patch

21 Nov 2024, 09:21

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: scsi: qla2xxx: arreglada por uno en qla_edif_app_getstats() La matriz app_reply->elem[] se asignó anteriormente en esta función y tiene elementos app_req.num_ports. Por lo tanto, esta > comparación necesita ser >= para evitar la corrupción de la memoria.
References () https://git.kernel.org/stable/c/4406e4176f47177f5e51b4cc7e6a7a2ff3dbfbbd - () https://git.kernel.org/stable/c/4406e4176f47177f5e51b4cc7e6a7a2ff3dbfbbd -
References () https://git.kernel.org/stable/c/60b87b5ecbe07d70897d35947b0bb3e76ccd1b3a - () https://git.kernel.org/stable/c/60b87b5ecbe07d70897d35947b0bb3e76ccd1b3a -
References () https://git.kernel.org/stable/c/8c820f7c8e9b46238d277c575392fe9930207aab - () https://git.kernel.org/stable/c/8c820f7c8e9b46238d277c575392fe9930207aab -
References () https://git.kernel.org/stable/c/9fc74e367be4247a5ac39bb8ec41eaa73fade510 - () https://git.kernel.org/stable/c/9fc74e367be4247a5ac39bb8ec41eaa73fade510 -
References () https://git.kernel.org/stable/c/ea8ac95c22c93acecb710209a7fd10b851afe817 - () https://git.kernel.org/stable/c/ea8ac95c22c93acecb710209a7fd10b851afe817 -

30 May 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-30 15:15

Updated : 2025-09-18 14:07

NVD link : CVE-2024-36025

Mitre link : CVE-2024-36025

CVE.ORG link : CVE-2024-36025

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-193

Off-by-one Error