CVE-2024-53110

CVE-2024-53110

High · published December 2, 2024

CVSS v3.1
7.3
EPSS
0%
Percentile
14.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

vp_vdpa: fix id_table array not null terminated error

Allocate one extra virtio_device_id as null terminator, otherwise

vdpa_mgmtdev_get_classes() may iterate multiple times and visit

undefined memory.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00243 · 14.7th percentile
Published
2024-12-02T19:15Z
Affected products (10)
ProductVersionsFixed in
linux/linux_kernel≥ 5.19, < 6.1.1196.1.119
linux/linux_kernel≥ 6.2, < 6.6.636.6.63
linux/linux_kernel≥ 6.7, < 6.11.106.11.10
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (5)
https://git.kernel.org/stable/c/0a886489d274596ad1a80789d3a773503210a615 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4e39ecadf1d2a08187139619f1f314b64ba7d947 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/870d68fe17b5d9032049dcad98b5781a344a8657 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c4d64534d4b1c47d2f1ce427497f971ad4735aae · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 02 DEC 13:44Z
    vp_vdpa: fix id_table array not null terminated error
    cvelistv5