CVE-2024-50188

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-50188
In the Linux kernel, the following vulnerability has been resolved: net: phy: dp83869: fix memory corruption when enabling fiber When configuring the fiber port, the DP83869 PHY driver incorrectly calls linkmode_set_bit() with a bit mask (1 << 10) rather than a bit number (10). This corrupts some other memory location -- in case of arm64 the priv pointer in the same structure. Since the advertising flags are updated from supported at the end of the function the incorrect line isn't needed at all and can be removed.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/21b5af7f0c99b3bf1fd02016e6708b613acbcaf4 Patch
https://git.kernel.org/stable/c/9ca634676ff66e1d616259e136f96f96b2a1759a Patch
https://git.kernel.org/stable/c/a842e443ca8184f2dc82ab307b43a8b38defd6a5 Patch
https://git.kernel.org/stable/c/ad0d76b8ee5db063791cc2e7a30ffc9852ac37c4 Patch
https://git.kernel.org/stable/c/c1944b4253649fc6f2fb53e7d6302eb414d2182c Patch
https://git.kernel.org/stable/c/e3f2de32dae35bc7d173377dc97b5bc9fcd9fc84 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*
History

27 Nov 2024, 16:14

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/21b5af7f0c99b3bf1fd02016e6708b613acbcaf4 - () https://git.kernel.org/stable/c/21b5af7f0c99b3bf1fd02016e6708b613acbcaf4 - Patch
References () https://git.kernel.org/stable/c/9ca634676ff66e1d616259e136f96f96b2a1759a - () https://git.kernel.org/stable/c/9ca634676ff66e1d616259e136f96f96b2a1759a - Patch
References () https://git.kernel.org/stable/c/a842e443ca8184f2dc82ab307b43a8b38defd6a5 - () https://git.kernel.org/stable/c/a842e443ca8184f2dc82ab307b43a8b38defd6a5 - Patch
References () https://git.kernel.org/stable/c/ad0d76b8ee5db063791cc2e7a30ffc9852ac37c4 - () https://git.kernel.org/stable/c/ad0d76b8ee5db063791cc2e7a30ffc9852ac37c4 - Patch
References () https://git.kernel.org/stable/c/c1944b4253649fc6f2fb53e7d6302eb414d2182c - () https://git.kernel.org/stable/c/c1944b4253649fc6f2fb53e7d6302eb414d2182c - Patch
References () https://git.kernel.org/stable/c/e3f2de32dae35bc7d173377dc97b5bc9fcd9fc84 - () https://git.kernel.org/stable/c/e3f2de32dae35bc7d173377dc97b5bc9fcd9fc84 - Patch
CWE NVD-CWE-noinfo
CPE cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
First Time Linux linux Kernel
Linux
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

08 Nov 2024, 19:01

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: phy: dp83869: se corrige la corrupción de memoria al habilitar la fibra Al configurar el puerto de fibra, el controlador PHY DP83869 llama incorrectamente a linkmode_set_bit() con una máscara de bits (1 &lt;&lt; 10) en lugar de un número de bit (10). Esto corrompe alguna otra ubicación de memoria; en el caso de arm64, el puntero priv en la misma estructura. Dado que los indicadores de publicidad se actualizan desde supported al final de la función, la línea incorrecta no es necesaria en absoluto y se puede eliminar.

08 Nov 2024, 06:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-11-08 06:15

Updated : 2024-11-27 16:14

NVD link : CVE-2024-50188

Mitre link : CVE-2024-50188

CVE.ORG link : CVE-2024-50188

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo