CVE-2024-53146

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-53146
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent a potential integer overflow If the tag length is >= U32_MAX - 3 then the "length + 4" addition can result in an integer overflow. Address this by splitting the decoding into several steps so that decode_cb_compound4res() does not have to perform arithmetic on the unsafe length value.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/084f797dbc7e52209a4ab6dbc7f0109268754eb9 Patch
https://git.kernel.org/stable/c/3c5f545c9a1f8a1869246f6f3ae8c17289d6a841 Patch
https://git.kernel.org/stable/c/745f7ce5a95e783ba62fe774325829466aec2aa8 Patch
https://git.kernel.org/stable/c/7f33b92e5b18e904a481e6e208486da43e4dc841 Patch
https://git.kernel.org/stable/c/842f1c27a1aef5367e535f9e85c8c3b06352151a Patch
https://git.kernel.org/stable/c/90adbae9dd158da8331d9fdd32077bd1af04f553 Patch
https://git.kernel.org/stable/c/ccd3394f9a7200d6b088553bf38e688620cd27af Patch
https://git.kernel.org/stable/c/dde654cad08fdaac370febb161ec41eb58e9d2a2 Patch
https://git.kernel.org/stable/c/de53c5305184ca1333b87e695d329d1502d694ce Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

07 Jan 2025, 17:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: NFSD: evita un posible desbordamiento de enteros. Si la longitud de la etiqueta es >= U32_MAX - 3, entonces la suma "longitud + 4" puede provocar un desbordamiento de enteros. Solucione este problema dividiendo la decodificación en varios pasos para que decode_cb_compound4res() no tenga que realizar aritmética en el valor de longitud no seguro.
CWE CWE-190
First Time Linux linux Kernel
Linux
References () https://git.kernel.org/stable/c/084f797dbc7e52209a4ab6dbc7f0109268754eb9 - () https://git.kernel.org/stable/c/084f797dbc7e52209a4ab6dbc7f0109268754eb9 - Patch
References () https://git.kernel.org/stable/c/3c5f545c9a1f8a1869246f6f3ae8c17289d6a841 - () https://git.kernel.org/stable/c/3c5f545c9a1f8a1869246f6f3ae8c17289d6a841 - Patch
References () https://git.kernel.org/stable/c/745f7ce5a95e783ba62fe774325829466aec2aa8 - () https://git.kernel.org/stable/c/745f7ce5a95e783ba62fe774325829466aec2aa8 - Patch
References () https://git.kernel.org/stable/c/7f33b92e5b18e904a481e6e208486da43e4dc841 - () https://git.kernel.org/stable/c/7f33b92e5b18e904a481e6e208486da43e4dc841 - Patch
References () https://git.kernel.org/stable/c/842f1c27a1aef5367e535f9e85c8c3b06352151a - () https://git.kernel.org/stable/c/842f1c27a1aef5367e535f9e85c8c3b06352151a - Patch
References () https://git.kernel.org/stable/c/90adbae9dd158da8331d9fdd32077bd1af04f553 - () https://git.kernel.org/stable/c/90adbae9dd158da8331d9fdd32077bd1af04f553 - Patch
References () https://git.kernel.org/stable/c/ccd3394f9a7200d6b088553bf38e688620cd27af - () https://git.kernel.org/stable/c/ccd3394f9a7200d6b088553bf38e688620cd27af - Patch
References () https://git.kernel.org/stable/c/dde654cad08fdaac370febb161ec41eb58e9d2a2 - () https://git.kernel.org/stable/c/dde654cad08fdaac370febb161ec41eb58e9d2a2 - Patch
References () https://git.kernel.org/stable/c/de53c5305184ca1333b87e695d329d1502d694ce - () https://git.kernel.org/stable/c/de53c5305184ca1333b87e695d329d1502d694ce - Patch

24 Dec 2024, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-24 12:15

Updated : 2025-01-07 17:15

NVD link : CVE-2024-53146

Mitre link : CVE-2024-53146

CVE.ORG link : CVE-2024-53146

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-190

Integer Overflow or Wraparound