CVE-2024-50143

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-50143
In the Linux kernel, the following vulnerability has been resolved: udf: fix uninit-value use in udf_get_fileshortad Check for overflow when computing alen in udf_current_aext to mitigate later uninit-value use in udf_get_fileshortad KMSAN bug[1]. After applying the patch reproducer did not trigger any issue[2]. [1] https://syzkaller.appspot.com/bug?extid=8901c4560b7ab5c2f9df [2] https://syzkaller.appspot.com/x/log.txt?x=10242227980000

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/1ac49babc952f48d82676979b20885e480e69be8 Patch
https://git.kernel.org/stable/c/264db9d666ad9a35075cc9ed9ec09d021580fbb1 Patch
https://git.kernel.org/stable/c/417bd613bdbe791549f7687bb1b9b8012ff111c2 Patch
https://git.kernel.org/stable/c/4fc0d8660e391dcd8dde23c44d702be1f6846c61 Patch
https://git.kernel.org/stable/c/5eb76fb98b3335aa5cca6a7db2e659561c79c32b Patch
https://git.kernel.org/stable/c/72e445df65a0aa9066c6fe2b8736ba2fcca6dac7 Patch
https://git.kernel.org/stable/c/e52e0b92ed31dc62afbda15c243dcee0bb5bb58d Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*
History

15 Nov 2024, 22:22

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/1ac49babc952f48d82676979b20885e480e69be8 - () https://git.kernel.org/stable/c/1ac49babc952f48d82676979b20885e480e69be8 - Patch
References () https://git.kernel.org/stable/c/264db9d666ad9a35075cc9ed9ec09d021580fbb1 - () https://git.kernel.org/stable/c/264db9d666ad9a35075cc9ed9ec09d021580fbb1 - Patch
References () https://git.kernel.org/stable/c/417bd613bdbe791549f7687bb1b9b8012ff111c2 - () https://git.kernel.org/stable/c/417bd613bdbe791549f7687bb1b9b8012ff111c2 - Patch
References () https://git.kernel.org/stable/c/4fc0d8660e391dcd8dde23c44d702be1f6846c61 - () https://git.kernel.org/stable/c/4fc0d8660e391dcd8dde23c44d702be1f6846c61 - Patch
References () https://git.kernel.org/stable/c/5eb76fb98b3335aa5cca6a7db2e659561c79c32b - () https://git.kernel.org/stable/c/5eb76fb98b3335aa5cca6a7db2e659561c79c32b - Patch
References () https://git.kernel.org/stable/c/72e445df65a0aa9066c6fe2b8736ba2fcca6dac7 - () https://git.kernel.org/stable/c/72e445df65a0aa9066c6fe2b8736ba2fcca6dac7 - Patch
References () https://git.kernel.org/stable/c/e52e0b92ed31dc62afbda15c243dcee0bb5bb58d - () https://git.kernel.org/stable/c/e52e0b92ed31dc62afbda15c243dcee0bb5bb58d - Patch
CWE CWE-908
First Time Linux linux Kernel
Linux
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*

08 Nov 2024, 16:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/417bd613bdbe791549f7687bb1b9b8012ff111c2 -
  • () https://git.kernel.org/stable/c/5eb76fb98b3335aa5cca6a7db2e659561c79c32b -
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: udf: se corrige el uso de un valor no inicializado en udf_get_fileshortad. Se comprueba si hay desbordamiento al calcular alen en udf_current_aext para mitigar el uso posterior de un valor no inicializado en udf_get_fileshortad. Error de KMSAN[1]. Después de aplicar el parche, el reproductor no activó ningún problema[2]. [1] https://syzkaller.appspot.com/bug?extid=8901c4560b7ab5c2f9df [2] https://syzkaller.appspot.com/x/log.txt?x=10242227980000

07 Nov 2024, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-11-07 10:15

Updated : 2024-11-15 22:22

NVD link : CVE-2024-50143

Mitre link : CVE-2024-50143

CVE.ORG link : CVE-2024-50143

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-908

Use of Uninitialized Resource