PT-2024-7317 · Linux+5 · Linux Kernel+5

Published

2024-02-20

·

Updated

2024-11-05

·

CVE-2024-26736

CVSS v3.1

7.8

High

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)
Description: The issue is related to a buffer overflow in the afs component of the Linux kernel. The max length of the volume->vid value is 20 characters, but the buffer size was not sufficient, leading to a potential overflow. The problem has been resolved by increasing the buffer size to 24 characters and using snprintf() to prevent overflow. This was found by the Linux Verification Center with SVACE.
Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Buffer Overflow

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-787CWE-119

Related Identifiers

BDU:2024-08671
CVE-2024-26736
DLA-3842-1
DSA-5658-1
DSA-5681-1
OESA-2024-1520
OESA-2024-1524
OESA-2024-1536
OESA-2024-1541
OPENSUSE-SU-2024_1490-1
OPENSUSE-SU-2024_1659-1
OPENSUSE-SU-2024_1663-1
SUSE-SU-2024:1490-1
SUSE-SU-2024:1659-1
SUSE-SU-2024:1663-1
SUSE-SU-2024:2135-1
USN-6820-1
USN-6820-2
USN-6821-1
USN-6821-2
USN-6821-3
USN-6821-4
USN-6828-1
USN-6831-1
USN-6866-1
USN-6866-2
USN-6866-3
USN-6867-1
USN-6871-1
USN-6892-1
USN-6895-1
USN-6895-2
USN-6895-3
USN-6895-4
USN-6900-1
USN-6919-1

Affected Products

Astra Linux
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu