CVE-2024-44966Improper Restriction of Operations within the Bounds of a Memory Buffer in Linux

Severity
5.5MEDIUMNVD
OSV8.8OSV7.1
EPSS
0.0%
top 92.86%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedSep 4
Latest updateJan 9

Description

In the Linux kernel, the following vulnerability has been resolved: binfmt_flat: Fix corruption when not offsetting data start Commit 04d82a6d0881 ("binfmt_flat: allow not offsetting data start") introduced a RISC-V specific variant of the FLAT format which does not allocate any space for the (obsolete) array of shared library pointers. However, it did not disable the code which initializes the array, resulting in the corruption of sizeof(long) bytes before the DATA segment, generally the end

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages10 packages

NVDlinux/linux_kernel5.135.15.165+4
Debianlinux/linux_kernel< 6.1.106-1+2
Ubuntulinux/linux_kernel< 5.15.0-125.135+1
CVEListV5linux/linux04d82a6d0881ef1ab1e9f66f10805177ee2fb1e83a684499261d0f7ed5ee72793025c88c2276809c+5
debiandebian/linux< linux 6.1.106-1 (bookworm)

Patches

🔴Vulnerability Details

12
OSV
linux-azure, linux-azure-6.8 vulnerabilities2025-01-09
OSV
linux-azure-5.15 vulnerabilities2025-01-09
OSV
linux-hwe-6.8 vulnerabilities2025-01-06
OSV
linux-gkeop vulnerabilities2024-12-12
OSV
linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency vulnerabilities2024-12-12

📋Vendor Advisories

13
Ubuntu
Linux kernel (Azure) vulnerabilities2025-01-09
Ubuntu
Linux kernel (Azure) vulnerabilities2025-01-09
Ubuntu
Linux kernel (HWE) vulnerabilities2025-01-06
Ubuntu
Linux kernel (GKE) vulnerabilities2024-12-12
Ubuntu
Linux kernel (NVIDIA) vulnerabilities2024-12-12