CVE-2024-38585

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-38585
In the Linux kernel, the following vulnerability has been resolved: tools/nolibc/stdlib: fix memory error in realloc() Pass user_p_len to memcpy() instead of heap->len to prevent realloc() from copying an extra sizeof(heap) bytes from beyond the allocated region.

7.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/4e6f225aefeb712cdb870176b6621f02cf235b8c Patch
https://git.kernel.org/stable/c/5996b2b2dac739f2a27da13de8eee5b85b2550b3 Patch
https://git.kernel.org/stable/c/791f4641142e2aced85de082e5783b4fb0b977c2 Patch
https://git.kernel.org/stable/c/8019d3dd921f39a237a9fab6d2ce716bfac0f983 Patch
https://git.kernel.org/stable/c/f678c3c336559cf3255a32153e9a17c1be4e7c15 Patch
https://git.kernel.org/stable/c/4e6f225aefeb712cdb870176b6621f02cf235b8c Patch
https://git.kernel.org/stable/c/5996b2b2dac739f2a27da13de8eee5b85b2550b3 Patch
https://git.kernel.org/stable/c/791f4641142e2aced85de082e5783b4fb0b977c2 Patch
https://git.kernel.org/stable/c/8019d3dd921f39a237a9fab6d2ce716bfac0f983 Patch
https://git.kernel.org/stable/c/f678c3c336559cf3255a32153e9a17c1be4e7c15 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

17 Sep 2025, 21:06

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/4e6f225aefeb712cdb870176b6621f02cf235b8c - () https://git.kernel.org/stable/c/4e6f225aefeb712cdb870176b6621f02cf235b8c - Patch
References () https://git.kernel.org/stable/c/5996b2b2dac739f2a27da13de8eee5b85b2550b3 - () https://git.kernel.org/stable/c/5996b2b2dac739f2a27da13de8eee5b85b2550b3 - Patch
References () https://git.kernel.org/stable/c/791f4641142e2aced85de082e5783b4fb0b977c2 - () https://git.kernel.org/stable/c/791f4641142e2aced85de082e5783b4fb0b977c2 - Patch
References () https://git.kernel.org/stable/c/8019d3dd921f39a237a9fab6d2ce716bfac0f983 - () https://git.kernel.org/stable/c/8019d3dd921f39a237a9fab6d2ce716bfac0f983 - Patch
References () https://git.kernel.org/stable/c/f678c3c336559cf3255a32153e9a17c1be4e7c15 - () https://git.kernel.org/stable/c/f678c3c336559cf3255a32153e9a17c1be4e7c15 - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.1
First Time Linux
Linux linux Kernel
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CWE CWE-125

21 Nov 2024, 09:26

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/4e6f225aefeb712cdb870176b6621f02cf235b8c - () https://git.kernel.org/stable/c/4e6f225aefeb712cdb870176b6621f02cf235b8c -
References () https://git.kernel.org/stable/c/5996b2b2dac739f2a27da13de8eee5b85b2550b3 - () https://git.kernel.org/stable/c/5996b2b2dac739f2a27da13de8eee5b85b2550b3 -
References () https://git.kernel.org/stable/c/791f4641142e2aced85de082e5783b4fb0b977c2 - () https://git.kernel.org/stable/c/791f4641142e2aced85de082e5783b4fb0b977c2 -
References () https://git.kernel.org/stable/c/8019d3dd921f39a237a9fab6d2ce716bfac0f983 - () https://git.kernel.org/stable/c/8019d3dd921f39a237a9fab6d2ce716bfac0f983 -
References () https://git.kernel.org/stable/c/f678c3c336559cf3255a32153e9a17c1be4e7c15 - () https://git.kernel.org/stable/c/f678c3c336559cf3255a32153e9a17c1be4e7c15 -

20 Jun 2024, 12:44

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tools/nolibc/stdlib: corrige el error de memoria en realloc() Pase user_p_len a memcpy() en lugar de heap->len para evitar que realloc() copie un tamaño extra de(heap) bytes más allá de la región asignada.

19 Jun 2024, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-19 14:15

Updated : 2025-09-17 21:06

NVD link : CVE-2024-38585

Mitre link : CVE-2024-38585

CVE.ORG link : CVE-2024-38585

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-125

Out-of-bounds Read