CVE-2024-36931

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-36931
In the Linux kernel, the following vulnerability has been resolved: s390/cio: Ensure the copied buf is NUL terminated Currently, we allocate a lbuf-sized kernel buffer and copy lbuf from userspace to that buffer. Later, we use scanf on this buffer but we don't ensure that the string is terminated inside the buffer, this can lead to OOB read when using scanf. Fix this issue by using memdup_user_nul instead.

7.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/06759ebaf75c19c87b2453a5e130e9e61e9b5d65 Patch
https://git.kernel.org/stable/c/10452edd175fcc4fd0f5ac782ed2a002e3e5d65c Patch
https://git.kernel.org/stable/c/84b38f48836662c4bfae646c014f4e981e16a2b2 Patch
https://git.kernel.org/stable/c/c9d48ce163305595ae20aee27774192476d5e6a5 Patch
https://git.kernel.org/stable/c/da7c622cddd4fe36be69ca61e8c42e43cde94784 Patch
https://git.kernel.org/stable/c/06759ebaf75c19c87b2453a5e130e9e61e9b5d65 Patch
https://git.kernel.org/stable/c/10452edd175fcc4fd0f5ac782ed2a002e3e5d65c Patch
https://git.kernel.org/stable/c/84b38f48836662c4bfae646c014f4e981e16a2b2 Patch
https://git.kernel.org/stable/c/c9d48ce163305595ae20aee27774192476d5e6a5 Patch
https://git.kernel.org/stable/c/da7c622cddd4fe36be69ca61e8c42e43cde94784 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc6:*:*:*:*:*:*
History

15 Jan 2025, 18:39

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/06759ebaf75c19c87b2453a5e130e9e61e9b5d65 - () https://git.kernel.org/stable/c/06759ebaf75c19c87b2453a5e130e9e61e9b5d65 - Patch
References () https://git.kernel.org/stable/c/10452edd175fcc4fd0f5ac782ed2a002e3e5d65c - () https://git.kernel.org/stable/c/10452edd175fcc4fd0f5ac782ed2a002e3e5d65c - Patch
References () https://git.kernel.org/stable/c/84b38f48836662c4bfae646c014f4e981e16a2b2 - () https://git.kernel.org/stable/c/84b38f48836662c4bfae646c014f4e981e16a2b2 - Patch
References () https://git.kernel.org/stable/c/c9d48ce163305595ae20aee27774192476d5e6a5 - () https://git.kernel.org/stable/c/c9d48ce163305595ae20aee27774192476d5e6a5 - Patch
References () https://git.kernel.org/stable/c/da7c622cddd4fe36be69ca61e8c42e43cde94784 - () https://git.kernel.org/stable/c/da7c622cddd4fe36be69ca61e8c42e43cde94784 - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.1
First Time Linux
Linux linux Kernel
CPE cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
CWE CWE-125

21 Nov 2024, 09:22

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: s390/cio: asegúrese de que el buf copiado tenga terminación NUL. Actualmente, asignamos un búfer del kernel del tamaño de lbuf y copiamos lbuf del espacio de usuario a ese búfer. Más adelante, usamos scanf en este búfer pero no nos aseguramos de que la cadena termine dentro del búfer, esto puede provocar una lectura OOB cuando usamos scanf. Solucione este problema utilizando memdup_user_nul en su lugar.
References () https://git.kernel.org/stable/c/06759ebaf75c19c87b2453a5e130e9e61e9b5d65 - () https://git.kernel.org/stable/c/06759ebaf75c19c87b2453a5e130e9e61e9b5d65 -
References () https://git.kernel.org/stable/c/10452edd175fcc4fd0f5ac782ed2a002e3e5d65c - () https://git.kernel.org/stable/c/10452edd175fcc4fd0f5ac782ed2a002e3e5d65c -
References () https://git.kernel.org/stable/c/84b38f48836662c4bfae646c014f4e981e16a2b2 - () https://git.kernel.org/stable/c/84b38f48836662c4bfae646c014f4e981e16a2b2 -
References () https://git.kernel.org/stable/c/c9d48ce163305595ae20aee27774192476d5e6a5 - () https://git.kernel.org/stable/c/c9d48ce163305595ae20aee27774192476d5e6a5 -
References () https://git.kernel.org/stable/c/da7c622cddd4fe36be69ca61e8c42e43cde94784 - () https://git.kernel.org/stable/c/da7c622cddd4fe36be69ca61e8c42e43cde94784 -

30 May 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-30 16:15

Updated : 2025-01-15 18:39

NVD link : CVE-2024-36931

Mitre link : CVE-2024-36931

CVE.ORG link : CVE-2024-36931

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-125

Out-of-bounds Read