CVE-2024-40902Classic Buffer Overflow in Linux

Severity
7.8HIGHNVD
OSV5.5OSV5.3
EPSS
0.0%
top 98.75%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedJul 12
Latest updateAug 14

Description

In the Linux kernel, the following vulnerability has been resolved: jfs: xattr: fix buffer overflow for invalid xattr When an xattr size is not what is expected, it is printed out to the kernel log in hex format as a form of debugging. But when that xattr size is bigger than the expected size, printing it out can cause an access off the end of the buffer. Fix this all up by properly restricting the size of the debug hex dump in the kernel log.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages14 packages

Patches

🔴Vulnerability Details

24
OSV
linux-azure vulnerabilities2024-10-17
OSV
linux-raspi-5.4 vulnerabilities2024-10-01
OSV
linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities2024-09-26
OSV
linux-raspi vulnerabilities2024-09-26
OSV
linux-azure-fde-5.15 vulnerabilities2024-09-25

📋Vendor Advisories

26
CISA ICS
Siemens Third-Party Components in SINEC OS2025-08-14
Ubuntu
Linux kernel (Azure) vulnerabilities2024-10-17
Ubuntu
Linux kernel vulnerabilities2024-10-01
Ubuntu
Linux kernel vulnerabilities2024-09-26
Ubuntu
Linux kernel vulnerabilities2024-09-26