CVE-2024-39480CWE-120CWE-121

CVE-2024-39480

High · published July 5, 2024

CVSS v3.1
8.4
EPSS
0%
Percentile
18.3
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

kdb: Fix buffer overflow during tab-complete

Currently, when the user attempts symbol completion with the Tab key, kdb

will use strncpy() to insert the completed symbol into the command buffer.

Unfortunately it passes the size of the source buffer rather than the

destination to strncpy() with predictably horrible results. Most obviously

if the command buffer is already full but cp, the cursor position, is in

the middle of the buffer, then we will write past the end of the supplied

buffer.

Fix this by replacing the dubious strncpy() calls with memmove()/memcpy()

calls plus explicit boundary checks to make sure we have enough space

before we start moving characters around.

The record
Technical detail
CVSS v3.1
8.4 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00271 · 18.3th percentile
Weaknesses
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'); CWE-121 · Stack-based Buffer Overflow
Published
2024-07-05T11:15Z
Affected products (7)
ProductVersionsFixed in
linux/linux_kernel≥ 4.19, < 4.19.3164.19.316
linux/linux_kernel≥ 5.4, < 5.4.2785.4.278
linux/linux_kernel≥ 5.10, < 5.10.2195.10.219
linux/linux_kernel≥ 5.15, < 5.15.1615.15.161
linux/linux_kernel≥ 6.1, < 6.1.946.1.94
linux/linux_kernel≥ 6.6, < 6.6.346.6.34
linux/linux_kernel≥ 6.9, < 6.9.56.9.5
References (16)
https://git.kernel.org/stable/c/107e825cc448b7834b31e8b1b3cf0f57426d46d5 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/33d9c814652b971461d1e30bead6792851c209e7 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/cfdc2fa4db57503bc6d3817240547c8ddc55fa96 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ddd2972d8e2dee3b33e8121669d55def59f0be8a · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e9730744bf3af04cda23799029342aa3cddbc454 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f636a40834d22e5e3fc748f060211879c056cd33 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f694da720dcf795dc3eb97bf76d220213f76aaa7 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/fb824a99e148ff272a53d71d84122728b5f00992 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/107e825cc448b7834b31e8b1b3cf0f57426d46d5 · af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/33d9c814652b971461d1e30bead6792851c209e7 · af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/cfdc2fa4db57503bc6d3817240547c8ddc55fa96 · af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/ddd2972d8e2dee3b33e8121669d55def59f0be8a · af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/e9730744bf3af04cda23799029342aa3cddbc454 · af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/f636a40834d22e5e3fc748f060211879c056cd33 · af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/f694da720dcf795dc3eb97bf76d220213f76aaa7 · af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/fb824a99e148ff272a53d71d84122728b5f00992 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 05 JUL 06:55Z
    kdb: Fix buffer overflow during tab-complete
    cvelistv5