github - ghsa-623v-cr64-76w9

ghsa-623v-cr64-76w9

Vulnerability from github

Published

2024-12-04 15:31

Modified

2024-12-11 18:30

Severity ?

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

In the Linux kernel, the following vulnerability has been resolved:

vdpa: solidrun: Fix UB bug with devres

In psnet_open_pf_bar() and snet_open_vf_bar() a string later passed to pcim_iomap_regions() is placed on the stack. Neither pcim_iomap_regions() nor the functions it calls copy that string.

Should the string later ever be used, this, consequently, causes undefined behavior since the stack frame will by then have disappeared.

Fix the bug by allocating the strings on the heap through devm_kasprintf().

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-53126"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-04T15:15:12Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nvdpa: solidrun: Fix UB bug with devres\n\nIn psnet_open_pf_bar() and snet_open_vf_bar() a string later passed to\npcim_iomap_regions() is placed on the stack. Neither\npcim_iomap_regions() nor the functions it calls copy that string.\n\nShould the string later ever be used, this, consequently, causes\nundefined behavior since the stack frame will by then have disappeared.\n\nFix the bug by allocating the strings on the heap through\ndevm_kasprintf().",
  "id": "GHSA-623v-cr64-76w9",
  "modified": "2024-12-11T18:30:38Z",
  "published": "2024-12-04T15:31:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53126"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0b364cf53b20204e92bac7c6ebd1ee7d3ec62931"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5bb287da2d2d5bb8f7376e223b02edb16998982e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d372dd09cfbf1324f54cbffd81fcaf6cdf3e608e"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

cve-2024-53126

Vulnerability from cvelistv5

Published

2024-12-04 14:20

Modified

2024-12-04 14:20

Severity ?

Summary

vdpa: solidrun: Fix UB bug with devres

References

▼	URL	Tags
	https://git.kernel.org/stable/c/d372dd09cfbf1324f54cbffd81fcaf6cdf3e608e
	https://git.kernel.org/stable/c/5bb287da2d2d5bb8f7376e223b02edb16998982e
	https://git.kernel.org/stable/c/0b364cf53b20204e92bac7c6ebd1ee7d3ec62931

Impacted products

Vendor

Product

Version

▼

Linux

Version: 51a8f9d7f587
Version: 51a8f9d7f587
Version: 51a8f9d7f587

Linux

Version: 6.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/vdpa/solidrun/snet_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d372dd09cfbf",
              "status": "affected",
              "version": "51a8f9d7f587",
              "versionType": "git"
            },
            {
              "lessThan": "5bb287da2d2d",
              "status": "affected",
              "version": "51a8f9d7f587",
              "versionType": "git"
            },
            {
              "lessThan": "0b364cf53b20",
              "status": "affected",
              "version": "51a8f9d7f587",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/vdpa/solidrun/snet_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.63",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvdpa: solidrun: Fix UB bug with devres\n\nIn psnet_open_pf_bar() and snet_open_vf_bar() a string later passed to\npcim_iomap_regions() is placed on the stack. Neither\npcim_iomap_regions() nor the functions it calls copy that string.\n\nShould the string later ever be used, this, consequently, causes\nundefined behavior since the stack frame will by then have disappeared.\n\nFix the bug by allocating the strings on the heap through\ndevm_kasprintf()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-04T14:20:30.788Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d372dd09cfbf1324f54cbffd81fcaf6cdf3e608e"
        },
        {
          "url": "https://git.kernel.org/stable/c/5bb287da2d2d5bb8f7376e223b02edb16998982e"
        },
        {
          "url": "https://git.kernel.org/stable/c/0b364cf53b20204e92bac7c6ebd1ee7d3ec62931"
        }
      ],
      "title": "vdpa: solidrun: Fix UB bug with devres",
      "x_generator": {
        "engine": "bippy-8e903de6a542"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-53126",
    "datePublished": "2024-12-04T14:20:30.788Z",
    "dateReserved": "2024-11-19T17:17:24.995Z",
    "dateUpdated": "2024-12-04T14:20:30.788Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted