CVE-2024-54456CWE-787

CVE-2024-54456

High · published February 27, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
12.6
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client()

name is char[64] where the size of clnt->cl_program->name remains

unknown. Invoking strcat() directly will also lead to potential buffer

overflow. Change them to strscpy() and strncat() to fix potential

issues.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00226 · 12.6th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2025-02-27T08:15Z
Affected products (3)
ProductVersionsFixed in
linux/linux_kernel≥ 6.5, < 6.6.796.6.79
linux/linux_kernel≥ 6.7, < 6.12.166.12.16
linux/linux_kernel≥ 6.13, < 6.13.46.13.4
References (4)
https://git.kernel.org/stable/c/19b3ca651b4b473878c73539febe477905041442 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/49fd4e34751e90e6df009b70cd0659dc839e7ca8 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/dd8830779b77f4d1206d28d02ad56a03fc0e78f7 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e8e0eb5601d4a6c74c336e3710afe3a0348c469d · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
EPSS history
Timeline
  • 27 FEB 02:18Z
    NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client()
    cvelistv5