CVE-2024-39482Allocation of Resources Without Limits or Throttling in Linux

Severity
5.5MEDIUMNVD
OSV6.5
EPSS
0.0%
top 95.11%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedJul 5
Latest updateAug 14

Description

In the Linux kernel, the following vulnerability has been resolved: bcache: fix variable length array abuse in btree_iter btree_iter is used in two ways: either allocated on the stack with a fixed size MAX_BSETS, or from a mempool with a dynamic size based on the specific cache set. Previously, the struct had a fixed-length array of size MAX_BSETS which was indexed out-of-bounds for the dynamically-sized iterators, which causes UBSAN to complain. This patch uses the same approach as in bcache

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages13 packages

Patches

🔴Vulnerability Details

13
OSV
linux-azure-fde-5.15 vulnerabilities2024-09-25
OSV
linux-lowlatency, linux-lowlatency-hwe-5.15 vulnerabilities2024-09-23
OSV
linux-ibm-5.15, linux-oracle-5.15 vulnerabilities2024-09-23
OSV
linux-xilinx-zynqmp vulnerabilities2024-09-18
OSV
linux-azure, linux-azure-5.15, linux-azure-fde vulnerabilities2024-09-13

📋Vendor Advisories

14
CISA ICS
Siemens Third-Party Components in SINEC OS2025-08-14
Ubuntu
Linux kernel vulnerabilities2024-09-25
Ubuntu
Linux kernel vulnerabilities2024-09-23
Ubuntu
Linux kernel vulnerabilities2024-09-23
Ubuntu
Linux kernel vulnerabilities2024-09-18