CVE-2024-42099
published 2024-07-30CVE-2024-42099: In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix invalid dereferencing of indirect CCW data pointer Fix invalid dereferencing…
PriorityP420medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.22%
12.0th percentile
In the Linux kernel, the following vulnerability has been resolved:
s390/dasd: Fix invalid dereferencing of indirect CCW data pointer
Fix invalid dereferencing of indirect CCW data pointer in
dasd_eckd_dump_sense() that leads to a kernel panic in error cases.
When using indirect addressing for DASD CCWs (IDAW) the CCW CDA pointer
does not contain the data address itself but a pointer to the IDAL.
This needs to be translated from physical to virtual as well before
using it.
This dereferencing is also used for dasd_page_cache and also fixed
although it is very unlikely that this code path ever gets used.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.9.9-1 (forky) | linux 6.9.9-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= c0bd39601c13ab08e961d77a90dfeeff56056353 < c116475f7d6410b1e6d399207ac75de6cf9c3652 | c116475f7d6410b1e6d399207ac75de6cf9c3652 |
| linux | linux | >= c0bd39601c13ab08e961d77a90dfeeff56056353 < b3a58f3b90f564f42a5c35778d8c5107b2c2150b | b3a58f3b90f564f42a5c35778d8c5107b2c2150b |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.9.9-1 | 6.9.9-1 |
| linux | linux_kernel | >= 0 < 6.9.9-1 | 6.9.9-1 |
| linux | linux_kernel | >= 6.9 < 6.9.9 | 6.9.9 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5LOW
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: s390/dasd: Fix invalid dereferencing of indirect CCW data pointer
vendor_redhat·2024-07-30·CVSS 5.5
CVE-2024-42099 [MEDIUM] CWE-404 kernel: s390/dasd: Fix invalid dereferencing of indirect CCW data pointer
kernel: s390/dasd: Fix invalid dereferencing of indirect CCW data pointer
In the Linux kernel, the following vulnerability has been resolved:
s390/dasd: Fix invalid dereferencing of indirect CCW data pointer
Fix invalid dereferencing of indirect CCW data pointer in
dasd_eckd_dump_sense() that leads to a kernel panic in error cases.
When using indirect addressing for DASD CCWs (IDAW) the CCW CDA pointer
does not contain the data address itself but a pointer to the IDAL.
This needs to be translated from physical to virtual as well before
using it.
This dereferencing is also used for dasd_page_cache and also fixed
although it is very unlikely that this code path ever gets used.
A vulnerability was found in the `s390/dasd` subsystem in the Linux Kernel, where an invalid dereferencing of an i
Debian
CVE-2024-42099: linux - In the Linux kernel, the following vulnerability has been resolved: s390/dasd: ...
vendor_debian·2024·CVSS 5.5
CVE-2024-42099 [MEDIUM] CVE-2024-42099: linux - In the Linux kernel, the following vulnerability has been resolved: s390/dasd: ...
In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix invalid dereferencing of indirect CCW data pointer Fix invalid dereferencing of indirect CCW data pointer in dasd_eckd_dump_sense() that leads to a kernel panic in error cases. When using indirect addressing for DASD CCWs (IDAW) the CCW CDA pointer does not contain the data address itself but a pointer to the IDAL. This needs to be translated from physical to virtual as well before using it. This dereferencing is also used for dasd_page_cache and also fixed although it is very unlikely that this code path ever gets used.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 6.9.9-1)
sid: resolved (fixed in 6.9.9-1)
trixie: resolved (fixed in 6.9.9-1)
GHSA
GHSA-hp2j-q576-5vvw: In the Linux kernel, the following vulnerability has been resolved:
s390/dasd: Fix invalid dereferencing of indirect CCW data pointer
Fix invalid de
ghsa_unreviewed·2024-07-30
CVE-2024-42099 [MEDIUM] CWE-476 GHSA-hp2j-q576-5vvw: In the Linux kernel, the following vulnerability has been resolved:
s390/dasd: Fix invalid dereferencing of indirect CCW data pointer
Fix invalid de
In the Linux kernel, the following vulnerability has been resolved:
s390/dasd: Fix invalid dereferencing of indirect CCW data pointer
Fix invalid dereferencing of indirect CCW data pointer in
dasd_eckd_dump_sense() that leads to a kernel panic in error cases.
When using indirect addressing for DASD CCWs (IDAW) the CCW CDA pointer
does not contain the data address itself but a pointer to the IDAL.
This needs to be translated from physical to virtual as well before
using it.
This dereferencing is also used for dasd_page_cache and also fixed
although it is very unlikely that this code path ever gets used.
OSV
CVE-2024-42099: In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix invalid dereferencing of indirect CCW data pointer Fix invalid dere
osv·2024-07-30·CVSS 5.5
CVE-2024-42099 [MEDIUM] CVE-2024-42099: In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix invalid dereferencing of indirect CCW data pointer Fix invalid dere
In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix invalid dereferencing of indirect CCW data pointer Fix invalid dereferencing of indirect CCW data pointer in dasd_eckd_dump_sense() that leads to a kernel panic in error cases. When using indirect addressing for DASD CCWs (IDAW) the CCW CDA pointer does not contain the data address itself but a pointer to the IDAL. This needs to be translated from physical to virtual as well before using it. This dereferencing is also used for dasd_page_cache and also fixed although it is very unlikely that this code path ever gets used.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-07-30
Published