CVE-2024-53101

In the Linux kernel, the following vulnerability has been resolved: fs: Fix uninitialized value issue in from_kuid and from_kgid ocfs2_setattr() uses attr->ia_mode, attr->ia_uid and attr->ia_gid in a trace point even though ATTR_MODE, ATTR_UID and ATTR_GID aren't set. Initialize all fields of newattrs to avoid uninitialized variables, by checking if ATTR_MODE, ATTR_UID, ATTR_GID are initialized, otherwise 0.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/15f34347481648a567db67fb473c23befb796af5	Patch
https://git.kernel.org/stable/c/17ecb40c5cc7755a321fb6148cba5797431ee5b8	Patch
https://git.kernel.org/stable/c/1c28bca1256aecece6e94b26b85cd07e08b0dc90	Patch
https://git.kernel.org/stable/c/1cb5bfc5bfc651982b6203c224d49b7ddacf28bc	Patch
https://git.kernel.org/stable/c/5a72b0d3497b818d8f000c347a7c11801eb27bfc	Patch
https://git.kernel.org/stable/c/9db25c2b41c34963c3ccf473b08171f87670652e	Patch
https://git.kernel.org/stable/c/a0c77e5e3dcbffc7c6080ccc89c037f0c86496cf	Patch
https://git.kernel.org/stable/c/b3e612bd8f64ce62e731e95f635e06a2efe3c80c	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:6.12:rc1::::::
	cpe:2.3:o:linux:linux_kernel:6.12:rc2::::::
	cpe:2.3:o:linux:linux_kernel:6.12:rc3::::::
	cpe:2.3:o:linux:linux_kernel:6.12:rc4::::::
	cpe:2.3:o:linux:linux_kernel:6.12:rc5::::::
	cpe:2.3:o:linux:linux_kernel:6.12:rc6::::::
	cpe:2.3:o:linux:linux_kernel:6.12:rc7::::::

History

19 Dec 2024, 18:08

Type	Values Removed	Values Added
First Time		Linux linux Kernel Linux
References	~~() https://git.kernel.org/stable/c/15f34347481648a567db67fb473c23befb796af5 -~~	() https://git.kernel.org/stable/c/15f34347481648a567db67fb473c23befb796af5 - Patch
References	~~() https://git.kernel.org/stable/c/17ecb40c5cc7755a321fb6148cba5797431ee5b8 -~~	() https://git.kernel.org/stable/c/17ecb40c5cc7755a321fb6148cba5797431ee5b8 - Patch
References	~~() https://git.kernel.org/stable/c/1c28bca1256aecece6e94b26b85cd07e08b0dc90 -~~	() https://git.kernel.org/stable/c/1c28bca1256aecece6e94b26b85cd07e08b0dc90 - Patch
References	~~() https://git.kernel.org/stable/c/1cb5bfc5bfc651982b6203c224d49b7ddacf28bc -~~	() https://git.kernel.org/stable/c/1cb5bfc5bfc651982b6203c224d49b7ddacf28bc - Patch
References	~~() https://git.kernel.org/stable/c/5a72b0d3497b818d8f000c347a7c11801eb27bfc -~~	() https://git.kernel.org/stable/c/5a72b0d3497b818d8f000c347a7c11801eb27bfc - Patch
References	~~() https://git.kernel.org/stable/c/9db25c2b41c34963c3ccf473b08171f87670652e -~~	() https://git.kernel.org/stable/c/9db25c2b41c34963c3ccf473b08171f87670652e - Patch
References	~~() https://git.kernel.org/stable/c/a0c77e5e3dcbffc7c6080ccc89c037f0c86496cf -~~	() https://git.kernel.org/stable/c/a0c77e5e3dcbffc7c6080ccc89c037f0c86496cf - Patch
References	~~() https://git.kernel.org/stable/c/b3e612bd8f64ce62e731e95f635e06a2efe3c80c -~~	() https://git.kernel.org/stable/c/b3e612bd8f64ce62e731e95f635e06a2efe3c80c - Patch
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.5
CWE		CWE-908
CPE		cpe:2.3:o:linux:linux_kernel:6.12:rc1:::::: cpe:2.3:o:linux:linux_kernel:::::::: cpe:2.3:o:linux:linux_kernel:6.12:rc3:::::: cpe:2.3:o:linux:linux_kernel:6.12:rc5:::::: cpe:2.3:o:linux:linux_kernel:6.12:rc7:::::: cpe:2.3:o:linux:linux_kernel:6.12:rc6:::::: cpe:2.3:o:linux:linux_kernel:6.12:rc2:::::: cpe:2.3:o:linux:linux_kernel:6.12:rc4::::::

25 Nov 2024, 22:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-11-25 22:15

Updated : 2024-12-19 18:08

NVD link : CVE-2024-53101

Mitre link : CVE-2024-53101

CVE.ORG link : CVE-2024-53101

JSON object : View

Products Affected

linux

linux_kernel

CWE

CWE-908

Use of Uninitialized Resource

{"id": "CVE-2024-53101", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2024-11-25T22:15:17.163", "references": [{"url": "https://git.kernel.org/stable/c/15f34347481648a567db67fb473c23befb796af5", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/17ecb40c5cc7755a321fb6148cba5797431ee5b8", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/1c28bca1256aecece6e94b26b85cd07e08b0dc90", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/1cb5bfc5bfc651982b6203c224d49b7ddacf28bc", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/5a72b0d3497b818d8f000c347a7c11801eb27bfc", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/9db25c2b41c34963c3ccf473b08171f87670652e", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a0c77e5e3dcbffc7c6080ccc89c037f0c86496cf", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b3e612bd8f64ce62e731e95f635e06a2efe3c80c", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-908"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: Fix uninitialized value issue in from_kuid and from_kgid\n\nocfs2_setattr() uses attr->ia_mode, attr->ia_uid and attr->ia_gid in\na trace point even though ATTR_MODE, ATTR_UID and ATTR_GID aren't set.\n\nInitialize all fields of newattrs to avoid uninitialized variables, by\nchecking if ATTR_MODE, ATTR_UID, ATTR_GID are initialized, otherwise 0."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: fs: Se soluciona el problema de los valores no inicializados en from_kuid y from_kgid ocfs2_setattr() utiliza attr->ia_mode, attr->ia_uid y attr->ia_gid en un punto de seguimiento aunque ATTR_MODE, ATTR_UID y ATTR_GID no est\u00e9n configurados. Inicializa todos los campos de newattrs para evitar variables no inicializadas, comprobando si ATTR_MODE, ATTR_UID, ATTR_GID est\u00e1n inicializados, de lo contrario, 0."}], "lastModified": "2024-12-19T18:08:23.857", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0EBF3108-DBF4-4E6D-B699-384F2299858B", "versionEndExcluding": "4.19.324"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9952C897-8A61-4D4B-9D6D-7D063E9EA15E", "versionEndExcluding": "5.4.286", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BF5B32D0-72C9-41C3-A0BB-D4946153C134", "versionEndExcluding": "5.10.230", "versionStartIncluding": "5.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B57DBF5A-67DF-4816-ABA5-ED8F60AF864C", "versionEndExcluding": "5.15.173", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F3F65A42-F5DB-44BC-976C-05128A6A683D", "versionEndExcluding": "6.1.118", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EBACFAEF-9696-41C6-8B03-B3C5947DCB1D", "versionEndExcluding": "6.6.62", "versionStartIncluding": "6.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "759504D4-BE53-492C-BA9B-70F6A9F409CA", "versionEndExcluding": "6.11.9", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7F361E1D-580F-4A2D-A509-7615F73167A1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "925478D0-3E3D-4E6F-ACD5-09F28D5DF82C"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3C95E234-D335-4B6C-96BF-E2CEBD8654ED"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E0F717D8-3014-4F84-8086-0124B2111379"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "24DBE6C7-2AAE-4818-AED2-E131F153D2FA"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "24B88717-53F5-42AA-9B72-14C707639E3F"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1EF8CD82-1EAE-4254-9545-F85AB94CF90F"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}

5.5 /10