CVE-2024-53146
Linux Kernel NFSD Integer Overflow Vulnerability
Description
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent a potential integer overflow If the tag length is >= U32_MAX - 3 then the "length + 4" addition can result in an integer overflow. Address this by splitting the decoding into several steps so that decode_cb_compound4res() does not have to perform arithmetic on the unsafe length value.
INFO
Published Date :
Dec. 24, 2024, 12:15 p.m.
Last Modified :
Jan. 7, 2025, 5:15 p.m.
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Remotely Exploitable :
No
Impact Score :
3.6
Exploitability Score :
1.8
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-53146.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-53146 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2024-53146 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Jan. 07, 2025
Action Type Old Value New Value Added CVSS V3.1 NIST AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE NIST CWE-190 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions up to (excluding) 4.19.325 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.20 up to (excluding) 5.4.287 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 up to (excluding) 5.10.231 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.174 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.120 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.64 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.11.11 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.12 up to (excluding) 6.12.2 Changed Reference Type https://git.kernel.org/stable/c/084f797dbc7e52209a4ab6dbc7f0109268754eb9 No Types Assigned https://git.kernel.org/stable/c/084f797dbc7e52209a4ab6dbc7f0109268754eb9 Patch Changed Reference Type https://git.kernel.org/stable/c/3c5f545c9a1f8a1869246f6f3ae8c17289d6a841 No Types Assigned https://git.kernel.org/stable/c/3c5f545c9a1f8a1869246f6f3ae8c17289d6a841 Patch Changed Reference Type https://git.kernel.org/stable/c/745f7ce5a95e783ba62fe774325829466aec2aa8 No Types Assigned https://git.kernel.org/stable/c/745f7ce5a95e783ba62fe774325829466aec2aa8 Patch Changed Reference Type https://git.kernel.org/stable/c/7f33b92e5b18e904a481e6e208486da43e4dc841 No Types Assigned https://git.kernel.org/stable/c/7f33b92e5b18e904a481e6e208486da43e4dc841 Patch Changed Reference Type https://git.kernel.org/stable/c/842f1c27a1aef5367e535f9e85c8c3b06352151a No Types Assigned https://git.kernel.org/stable/c/842f1c27a1aef5367e535f9e85c8c3b06352151a Patch Changed Reference Type https://git.kernel.org/stable/c/90adbae9dd158da8331d9fdd32077bd1af04f553 No Types Assigned https://git.kernel.org/stable/c/90adbae9dd158da8331d9fdd32077bd1af04f553 Patch Changed Reference Type https://git.kernel.org/stable/c/ccd3394f9a7200d6b088553bf38e688620cd27af No Types Assigned https://git.kernel.org/stable/c/ccd3394f9a7200d6b088553bf38e688620cd27af Patch Changed Reference Type https://git.kernel.org/stable/c/dde654cad08fdaac370febb161ec41eb58e9d2a2 No Types Assigned https://git.kernel.org/stable/c/dde654cad08fdaac370febb161ec41eb58e9d2a2 Patch Changed Reference Type https://git.kernel.org/stable/c/de53c5305184ca1333b87e695d329d1502d694ce No Types Assigned https://git.kernel.org/stable/c/de53c5305184ca1333b87e695d329d1502d694ce Patch -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Dec. 24, 2024
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent a potential integer overflow If the tag length is >= U32_MAX - 3 then the "length + 4" addition can result in an integer overflow. Address this by splitting the decoding into several steps so that decode_cb_compound4res() does not have to perform arithmetic on the unsafe length value. Added Reference https://git.kernel.org/stable/c/084f797dbc7e52209a4ab6dbc7f0109268754eb9 Added Reference https://git.kernel.org/stable/c/3c5f545c9a1f8a1869246f6f3ae8c17289d6a841 Added Reference https://git.kernel.org/stable/c/745f7ce5a95e783ba62fe774325829466aec2aa8 Added Reference https://git.kernel.org/stable/c/7f33b92e5b18e904a481e6e208486da43e4dc841 Added Reference https://git.kernel.org/stable/c/842f1c27a1aef5367e535f9e85c8c3b06352151a Added Reference https://git.kernel.org/stable/c/90adbae9dd158da8331d9fdd32077bd1af04f553 Added Reference https://git.kernel.org/stable/c/ccd3394f9a7200d6b088553bf38e688620cd27af Added Reference https://git.kernel.org/stable/c/dde654cad08fdaac370febb161ec41eb58e9d2a2 Added Reference https://git.kernel.org/stable/c/de53c5305184ca1333b87e695d329d1502d694ce
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-53146 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-53146
weaknesses.