CVE-2024-26763Out-of-bounds Write in Linux

Severity
7.1HIGHNVD
OSV7.8OSV7.0OSV6.5OSV5.5
EPSS
0.0%
top 97.39%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedApr 3
Latest updateAug 14

Description

In the Linux kernel, the following vulnerability has been resolved: dm-crypt: don't modify the data when using authenticated encryption It was said that authenticated encryption could produce invalid tag when the data that is being encrypted is modified [1]. So, fix this problem by copying the data into the clone bio first and then encrypt them inside the clone bio. This may reduce performance, but it is needed to prevent the user from corrupting the device by writing data with O_DIRECT and m

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HExploitability: 1.8 | Impact: 5.2

Affected Packages5 packages

NVDlinux/linux_kernel4.205.4.270+7
Debianlinux/linux_kernel< 5.10.216-1+3
Ubuntulinux/linux_kernel< 5.4.0-186.206+1
CVEListV5linux/linuxef43aa38063a6b2b3c6618e28ab35794f4f1fe2943a202bd552976497474ae144942e32cc5f34d7e+8
debiandebian/linux< linux 6.1.82-1 (bookworm)

Also affects: Debian Linux 10.0

Patches

🔴Vulnerability Details

14
OSV
linux-raspi vulnerabilities2024-07-26
OSV
linux-ibm-5.15 vulnerabilities2024-07-10
OSV
linux-hwe-5.15 vulnerabilities2024-07-04
OSV
linux-bluefield, linux-iot vulnerabilities2024-07-03
OSV
linux-azure, linux-azure-fde vulnerabilities2024-06-14

📋Vendor Advisories

14
CISA ICS
Siemens SINEC OS2025-08-14
Ubuntu
Linux kernel vulnerabilities2024-07-26
Ubuntu
Linux kernel (IBM) vulnerabilities2024-07-10
Ubuntu
Linux kernel (HWE) vulnerabilities2024-07-04
Ubuntu
Linux kernel (Azure) vulnerabilities2024-06-14

💬Community

1
Bugzilla
CVE-2024-26763 kernel: dm-crypt: don't modify the data when using authenticated encryption2024-04-04