CVE-2024-47695

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-47695
In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds In the function init_conns(), after the create_con() and create_cm() for loop if something fails. In the cleanup for loop after the destroy tag, we access out of bound memory because cid is set to clt_path->s.con_num. This commits resets the cid to clt_path->s.con_num - 1, to stay in bounds in the cleanup loop later.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/01b9be936ee8839ab9f83a7e84ee02ac6c8303c4 Patch
https://git.kernel.org/stable/c/0429a4e972082e3a2351da414b1c017daaf8aed2 Patch
https://git.kernel.org/stable/c/1c50e0265fa332c94a4a182e4efa0fc70d8fad94 Patch
https://git.kernel.org/stable/c/3e4289b29e216a55d08a89e126bc0b37cbad9f38 Patch
https://git.kernel.org/stable/c/5ac73f8191f3de41fef4f934d84d97f3aadb301f Patch
https://git.kernel.org/stable/c/c8b7f3d9fada0d4b4b7db86bf7345cd61f1d972e Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

23 Oct 2024, 21:32

Type Values Removed Values Added
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CWE CWE-787
References () https://git.kernel.org/stable/c/01b9be936ee8839ab9f83a7e84ee02ac6c8303c4 - () https://git.kernel.org/stable/c/01b9be936ee8839ab9f83a7e84ee02ac6c8303c4 - Patch
References () https://git.kernel.org/stable/c/0429a4e972082e3a2351da414b1c017daaf8aed2 - () https://git.kernel.org/stable/c/0429a4e972082e3a2351da414b1c017daaf8aed2 - Patch
References () https://git.kernel.org/stable/c/1c50e0265fa332c94a4a182e4efa0fc70d8fad94 - () https://git.kernel.org/stable/c/1c50e0265fa332c94a4a182e4efa0fc70d8fad94 - Patch
References () https://git.kernel.org/stable/c/3e4289b29e216a55d08a89e126bc0b37cbad9f38 - () https://git.kernel.org/stable/c/3e4289b29e216a55d08a89e126bc0b37cbad9f38 - Patch
References () https://git.kernel.org/stable/c/5ac73f8191f3de41fef4f934d84d97f3aadb301f - () https://git.kernel.org/stable/c/5ac73f8191f3de41fef4f934d84d97f3aadb301f - Patch
References () https://git.kernel.org/stable/c/c8b7f3d9fada0d4b4b7db86bf7345cd61f1d972e - () https://git.kernel.org/stable/c/c8b7f3d9fada0d4b4b7db86bf7345cd61f1d972e - Patch
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: RDMA/rtrs-clt: Restablecer cid a con_num - 1 para permanecer dentro de los límites En la función init_conns(), después del bucle for create_con() y create_cm() si algo falla. En el bucle for de limpieza después de la etiqueta destroy, accedemos a memoria fuera de los límites porque cid está configurado en clt_path->s.con_num. Esta confirmación restablece el cid a clt_path->s.con_num - 1, para permanecer dentro de los límites en el bucle de limpieza más tarde.

21 Oct 2024, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-10-21 12:15

Updated : 2024-10-23 21:32

NVD link : CVE-2024-47695

Mitre link : CVE-2024-47695

CVE.ORG link : CVE-2024-47695

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-787

Out-of-bounds Write