cbcvebase.
CVE-2024-26982
published 2024-05-01

CVE-2024-26982: In the Linux kernel, the following vulnerability has been resolved: Squashfs: check the inode number is not the invalid value of zero Syskiller has produced an…

PriorityP430high7.1CVSS 3.1
AVLACLPRLUINSUCHINAH
EPSS
0.28%
20.3th percentile
In the Linux kernel, the following vulnerability has been resolved: Squashfs: check the inode number is not the invalid value of zero Syskiller has produced an out of bounds access in fill_meta_index(). That out of bounds access is ultimately caused because the inode has an inode number with the invalid value of zero, which was not checked. The reason this causes the out of bounds access is due to following sequence of events: 1. Fill_meta_index() is called to allocate (via empty_meta_index()) and fill a metadata index. It however suffers a data read error and aborts, invalidating the newly returned empty metadata index. It does this by setting the inode number of the index to zero, which means unused (zero is not a valid inode number). 2. When fill_meta_index() is subsequently called again on another read operation, locate_meta_index() returns the previous index because it matches the inode number of 0. Because this index has been returned it is expected to have been filled, and because it hasn't been, an out of bounds access is performed. This patch adds a sanity check which checks that the inode number is not zero when the inode is created and returns -EINVAL if it is. [[email protected]: whitespace fix]

Affected

22 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.133-1 (bookworm)linux 6.1.133-1 (bookworm)
debianlinux-6.1< linux 6.1.133-1 (bookworm)linux 6.1.133-1 (bookworm)
linuxlinux
linuxlinux>= 6545b246a2c815a8fcd07d58240effb6ec3481b1 < 32c114a58236fe67141634774559f21f1dc96fd732c114a58236fe67141634774559f21f1dc96fd7
linuxlinux>= 6545b246a2c815a8fcd07d58240effb6ec3481b1 < 4a1b6f89825e267e156ccaeba3d235edcac77f944a1b6f89825e267e156ccaeba3d235edcac77f94
linuxlinux>= 6545b246a2c815a8fcd07d58240effb6ec3481b1 < cf46f88b92cfc0e32bd8a21ba1273cff13b8745fcf46f88b92cfc0e32bd8a21ba1273cff13b8745f
linuxlinux>= 6545b246a2c815a8fcd07d58240effb6ec3481b1 < 5b99dea79650b50909c50aba24fbae00f203f0135b99dea79650b50909c50aba24fbae00f203f013
linuxlinux>= 6545b246a2c815a8fcd07d58240effb6ec3481b1 < be383effaee3d89034f0828038f95065b518772ebe383effaee3d89034f0828038f95065b518772e
linuxlinux>= 6545b246a2c815a8fcd07d58240effb6ec3481b1 < 7def00ebc9f2d6a581ddf46ce4541f84a10680e57def00ebc9f2d6a581ddf46ce4541f84a10680e5
linuxlinux>= 6545b246a2c815a8fcd07d58240effb6ec3481b1 < 9253c54e01b6505d348afbc02abaa4d9f8a013959253c54e01b6505d348afbc02abaa4d9f8a01395
linuxlinux_kernel< 6.6.306.6.30
linuxlinux_kernel
linuxlinux_kernel>= 0 < 5.10.237-15.10.237-1
linuxlinux_kernel>= 0 < 6.1.133-16.1.133-1
linuxlinux_kernel>= 0 < 6.8.9-16.8.9-1
linuxlinux_kernel>= 0 < 6.8.9-16.8.9-1
linuxlinux_kernel>= 0 < 5.4.0-216.2365.4.0-216.236
linuxlinux_kernel>= 0 < 5.15.0-140.1505.15.0-140.150
linuxlinux_kernel>= 0 < 6.8.0-38.386.8.0-38.38
linuxlinux_kernel>= 6.7 < 6.8.86.8.8
msrccbl2_kernel_5.15.179.1-1_on_cbl_mariner_2.0
msrccbl2_kernel_5.15.182.1-1_on_cbl_mariner_2.0

CVSS provenance

nvdv3.17.1HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
osv8.8HIGH
vendor_ubuntu8.8HIGH
vendor_debian7.1HIGH
vendor_msrc7.1HIGH
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.