CVE-2024-38623

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-38623
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Use variable length array instead of fixed size Should fix smatch warning: ntfs_set_label() error: __builtin_memcpy() 'uni->name' too small (20 vs 256)

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/1997cdc3e727526aa5d84b32f7cbb3f56459b7ef Patch
https://git.kernel.org/stable/c/1fe1c9dc21ee52920629d2d9b9bd84358931a8d1 Patch
https://git.kernel.org/stable/c/3839a9b19a4b70eff6b6ad70446f639f7fd5a3d7 Patch
https://git.kernel.org/stable/c/a2de301d90b782ac5d7a5fe32995caaee9ab3a0f Patch
https://git.kernel.org/stable/c/cceef44b34819c24bb6ed70dce5b524bd3e368d1 Patch
https://git.kernel.org/stable/c/1997cdc3e727526aa5d84b32f7cbb3f56459b7ef Patch
https://git.kernel.org/stable/c/1fe1c9dc21ee52920629d2d9b9bd84358931a8d1 Patch
https://git.kernel.org/stable/c/3839a9b19a4b70eff6b6ad70446f639f7fd5a3d7 Patch
https://git.kernel.org/stable/c/a2de301d90b782ac5d7a5fe32995caaee9ab3a0f Patch
https://git.kernel.org/stable/c/cceef44b34819c24bb6ed70dce5b524bd3e368d1 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

24 Mar 2025, 18:10

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/1997cdc3e727526aa5d84b32f7cbb3f56459b7ef - () https://git.kernel.org/stable/c/1997cdc3e727526aa5d84b32f7cbb3f56459b7ef - Patch
References () https://git.kernel.org/stable/c/1fe1c9dc21ee52920629d2d9b9bd84358931a8d1 - () https://git.kernel.org/stable/c/1fe1c9dc21ee52920629d2d9b9bd84358931a8d1 - Patch
References () https://git.kernel.org/stable/c/3839a9b19a4b70eff6b6ad70446f639f7fd5a3d7 - () https://git.kernel.org/stable/c/3839a9b19a4b70eff6b6ad70446f639f7fd5a3d7 - Patch
References () https://git.kernel.org/stable/c/a2de301d90b782ac5d7a5fe32995caaee9ab3a0f - () https://git.kernel.org/stable/c/a2de301d90b782ac5d7a5fe32995caaee9ab3a0f - Patch
References () https://git.kernel.org/stable/c/cceef44b34819c24bb6ed70dce5b524bd3e368d1 - () https://git.kernel.org/stable/c/cceef44b34819c24bb6ed70dce5b524bd3e368d1 - Patch
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

21 Nov 2024, 09:26

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/1997cdc3e727526aa5d84b32f7cbb3f56459b7ef - () https://git.kernel.org/stable/c/1997cdc3e727526aa5d84b32f7cbb3f56459b7ef -
References () https://git.kernel.org/stable/c/1fe1c9dc21ee52920629d2d9b9bd84358931a8d1 - () https://git.kernel.org/stable/c/1fe1c9dc21ee52920629d2d9b9bd84358931a8d1 -
References () https://git.kernel.org/stable/c/3839a9b19a4b70eff6b6ad70446f639f7fd5a3d7 - () https://git.kernel.org/stable/c/3839a9b19a4b70eff6b6ad70446f639f7fd5a3d7 -
References () https://git.kernel.org/stable/c/a2de301d90b782ac5d7a5fe32995caaee9ab3a0f - () https://git.kernel.org/stable/c/a2de301d90b782ac5d7a5fe32995caaee9ab3a0f -
References () https://git.kernel.org/stable/c/cceef44b34819c24bb6ed70dce5b524bd3e368d1 - () https://git.kernel.org/stable/c/cceef44b34819c24bb6ed70dce5b524bd3e368d1 -

03 Jul 2024, 02:05

Type Values Removed Values Added
CWE CWE-129
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: fs/ntfs3: use una matriz de longitud variable en lugar de un tamaño fijo. Debería corregirse la advertencia de coincidencia: error ntfs_set_label(): __builtin_memcpy() 'uni->name' demasiado pequeño (20 vs 256)
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8

21 Jun 2024, 11:22

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-21 11:15

Updated : 2025-03-24 18:10

NVD link : CVE-2024-38623

Mitre link : CVE-2024-38623

CVE.ORG link : CVE-2024-38623

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-129

Improper Validation of Array Index