CVE-2024-39482 (GCVE-0-2024-39482)
Vulnerability from cvelistv5 – Published: 2024-07-05 06:55 – Updated: 2026-08-05 11:33
VLAI
EPSS
VEX
Title
bcache: fix variable length array abuse in btree_iter
Summary
In the Linux kernel, the following vulnerability has been resolved:
bcache: fix variable length array abuse in btree_iter
btree_iter is used in two ways: either allocated on the stack with a
fixed size MAX_BSETS, or from a mempool with a dynamic size based on the
specific cache set. Previously, the struct had a fixed-length array of
size MAX_BSETS which was indexed out-of-bounds for the dynamically-sized
iterators, which causes UBSAN to complain.
This patch uses the same approach as in bcachefs's sort_iter and splits
the iterator into a btree_iter with a flexible array member and a
btree_iter_stack which embeds a btree_iter as well as a fixed-length
data array.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
9 references
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
cafe563591446cf80bfbc2fe3bc72a2e36cf1060 , < 2c3d7b03b658dc8bfa6112b194b67b92a87e081b
(git)
Affected: cafe563591446cf80bfbc2fe3bc72a2e36cf1060 , < 5a1922adc5798b7ec894cd3f197afb6f9591b023 (git) Affected: cafe563591446cf80bfbc2fe3bc72a2e36cf1060 , < 934e1e4331859183a861f396d7dfaf33cb5afb02 (git) Affected: cafe563591446cf80bfbc2fe3bc72a2e36cf1060 , < 6479b9f41583b013041943c4602e1ad61cec8148 (git) Affected: cafe563591446cf80bfbc2fe3bc72a2e36cf1060 , < 0c31344e22dd8d6b1394c6e4c41d639015bdc671 (git) Affected: cafe563591446cf80bfbc2fe3bc72a2e36cf1060 , < 3a861560ccb35f2a4f0a4b8207fa7c2a35fc7f31 (git) |
|
| Linux | Linux |
Affected:
3.10
Unaffected: 0 , < 3.10 (semver) Unaffected: 5.10.221 , ≤ 5.10.* (semver) Unaffected: 5.15.162 , ≤ 5.15.* (semver) Unaffected: 6.1.94 , ≤ 6.1.* (semver) Unaffected: 6.6.34 , ≤ 6.6.* (semver) Unaffected: 6.9.5 , ≤ 6.9.* (semver) Unaffected: 6.10 , ≤ * (original_commit_for_fix) |
|
| Siemens | RUGGEDCOM RST2428P |
Affected:
0 , < V3.1
(custom)
|
|
| Siemens | RUGGEDCOM RST2428P |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | SCALANCE XCM-/XRM-/XCH-/XRH-300 family |
Affected:
0 , < V3.1
(custom)
|
|
| Siemens | SCALANCE XCM-/XRM-/XCH-/XRH-300 family |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | SIMATIC S7-1500 TM MFP - GNU/Linux subsystem |
Affected:
0 , < *
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-39482",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-08T17:54:07.988323Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-08T17:54:15.435Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T04:26:15.917Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/2c3d7b03b658dc8bfa6112b194b67b92a87e081b"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/5a1922adc5798b7ec894cd3f197afb6f9591b023"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/934e1e4331859183a861f396d7dfaf33cb5afb02"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/6479b9f41583b013041943c4602e1ad61cec8148"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/0c31344e22dd8d6b1394c6e4c41d639015bdc671"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/3a861560ccb35f2a4f0a4b8207fa7c2a35fc7f31"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RST2428P",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V3.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RST2428P",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SCALANCE XCM-/XRM-/XCH-/XRH-300 family",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V3.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SCALANCE XCM-/XRM-/XCH-/XRH-300 family",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-12T11:55:25.412Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-613116.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-355557.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/bcache/bset.c",
"drivers/md/bcache/bset.h",
"drivers/md/bcache/btree.c",
"drivers/md/bcache/super.c",
"drivers/md/bcache/sysfs.c",
"drivers/md/bcache/writeback.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2c3d7b03b658dc8bfa6112b194b67b92a87e081b",
"status": "affected",
"version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
"versionType": "git"
},
{
"lessThan": "5a1922adc5798b7ec894cd3f197afb6f9591b023",
"status": "affected",
"version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
"versionType": "git"
},
{
"lessThan": "934e1e4331859183a861f396d7dfaf33cb5afb02",
"status": "affected",
"version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
"versionType": "git"
},
{
"lessThan": "6479b9f41583b013041943c4602e1ad61cec8148",
"status": "affected",
"version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
"versionType": "git"
},
{
"lessThan": "0c31344e22dd8d6b1394c6e4c41d639015bdc671",
"status": "affected",
"version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
"versionType": "git"
},
{
"lessThan": "3a861560ccb35f2a4f0a4b8207fa7c2a35fc7f31",
"status": "affected",
"version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/bcache/bset.c",
"drivers/md/bcache/bset.h",
"drivers/md/bcache/btree.c",
"drivers/md/bcache/super.c",
"drivers/md/bcache/sysfs.c",
"drivers/md/bcache/writeback.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.10"
},
{
"lessThan": "3.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.162",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.9.*",
"status": "unaffected",
"version": "6.9.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.10",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.221",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.162",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.94",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.34",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.9.5",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.10",
"versionStartIncluding": "3.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbcache: fix variable length array abuse in btree_iter\n\nbtree_iter is used in two ways: either allocated on the stack with a\nfixed size MAX_BSETS, or from a mempool with a dynamic size based on the\nspecific cache set. Previously, the struct had a fixed-length array of\nsize MAX_BSETS which was indexed out-of-bounds for the dynamically-sized\niterators, which causes UBSAN to complain.\n\nThis patch uses the same approach as in bcachefs\u0027s sort_iter and splits\nthe iterator into a btree_iter with a flexible array member and a\nbtree_iter_stack which embeds a btree_iter as well as a fixed-length\ndata array."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is the bcache btree-node read path, reached only through local block I/O to a bcache device (`cached_dev_submit_bio` \u2192 `cache_lookup` \u2192 `bch_btree_node_read_done`) or local registration of a cache device. There is no network-facing consumer of this code.\nAC:L - The out-of-bounds indexing is deterministic, not a race: `iter-\u003esize` is set to `bucket_size/block_size` (1024 with the default 512K/512B geometry) against a declared 4-element array, so every btree node carrying more than MAX_BSETS bsets walks past the array bound. An attacker who supplies the cache device additionally controls the bset count and the bucket/block geometry directly.\nPR:L - No capability check exists on the path \u2014 an unprivileged local user\u0027s ordinary file I/O on a bcache-backed filesystem causes btree cache misses that call `bch_btree_node_get()` \u2192 `bch_btree_node_read_done()` and run the oversized iterator. Root is only needed for the stronger variant where the attacker also supplies a crafted cache superblock.\nUI:N - No victim action is required; the out-of-bounds accesses occur during normal read servicing on an already-configured bcache device. Even the crafted-device variant is auto-triggered by bcache-tools\u0027 udev register rule rather than by any user step.\nS:U - The corruption is confined to kernel slab memory belonging to the bcache cache set, within the same security authority as the kernel itself. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - `heap_add`/`heap_sift`/`heap_pop` read and write `btree_iter_set` entries (pairs of `struct bkey *`) far beyond the declared four-element array, and in `CONFIG_BCACHE_DEBUG` builds and with buckets exceeding the `meta_bucket_pages()` cap the mempool object is genuinely undersized, so adjacent slab contents are read back as bkey pointers and dereferenced by `btree_mergesort()`, giving an out-of-bounds read primitive usable for disclosure.\nI:H - This is an out-of-bounds write of attacker-influenced pointer values into adjacent slab objects whenever the allocation is short of `iter-\u003esize`, and the sift/swap operations shuffle those entries arbitrarily. Corrupting neighbouring heap objects with controlled pointers is a classic path to control-flow hijack.\nA:H - Slab corruption from the out-of-bounds heap operations causes oopses, `bch_btree_iter_push()` hits a `BUG_ON` when the heap fills, and on kernels built with UBSAN array-bounds trapping the out-of-range index is a hard trap producing an immediate panic \u2014 all reachable repeatedly through ordinary I/O."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T11:33:36.233Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2c3d7b03b658dc8bfa6112b194b67b92a87e081b"
},
{
"url": "https://git.kernel.org/stable/c/5a1922adc5798b7ec894cd3f197afb6f9591b023"
},
{
"url": "https://git.kernel.org/stable/c/934e1e4331859183a861f396d7dfaf33cb5afb02"
},
{
"url": "https://git.kernel.org/stable/c/6479b9f41583b013041943c4602e1ad61cec8148"
},
{
"url": "https://git.kernel.org/stable/c/0c31344e22dd8d6b1394c6e4c41d639015bdc671"
},
{
"url": "https://git.kernel.org/stable/c/3a861560ccb35f2a4f0a4b8207fa7c2a35fc7f31"
}
],
"title": "bcache: fix variable length array abuse in btree_iter",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-39482",
"datePublished": "2024-07-05T06:55:10.599Z",
"dateReserved": "2024-06-25T14:23:23.746Z",
"dateUpdated": "2026-08-05T11:33:36.233Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2024-39482",
"date": "2026-08-07",
"epss": "0.00238",
"percentile": "0.14881"
},
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.10\", \"versionEndExcluding\": \"5.10.221\", \"matchCriteriaId\": \"520E9C39-AB38-4A1C-B857-2030B4982A71\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.15\", \"versionEndExcluding\": \"5.15.162\", \"matchCriteriaId\": \"4626E4B7-D5F4-42CC-93A8-B73E6384273F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.1\", \"versionEndExcluding\": \"6.1.94\", \"matchCriteriaId\": \"B5A86346-2984-4261-AC12-29EACB186000\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.6\", \"versionEndExcluding\": \"6.6.34\", \"matchCriteriaId\": \"AC0C6E24-8240-425A-BD1A-F78E6D3A67FC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.9\", \"versionEndExcluding\": \"6.9.5\", \"matchCriteriaId\": \"54EDFD02-25E6-4BC8-9AD0-0A59881F400A\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbcache: fix variable length array abuse in btree_iter\\n\\nbtree_iter is used in two ways: either allocated on the stack with a\\nfixed size MAX_BSETS, or from a mempool with a dynamic size based on the\\nspecific cache set. Previously, the struct had a fixed-length array of\\nsize MAX_BSETS which was indexed out-of-bounds for the dynamically-sized\\niterators, which causes UBSAN to complain.\\n\\nThis patch uses the same approach as in bcachefs\u0027s sort_iter and splits\\nthe iterator into a btree_iter with a flexible array member and a\\nbtree_iter_stack which embeds a btree_iter as well as a fixed-length\\ndata array.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bcache: corrige el abuso de matriz de longitud variable en btree_iter btree_iter se usa de dos maneras: ya sea asignado en la pila con un tama\\u00f1o fijo MAX_BSETS, o desde un mempool con un tama\\u00f1o din\\u00e1mico basado en el conjunto de cach\\u00e9 espec\\u00edfico. Anteriormente, la estructura ten\\u00eda una matriz de longitud fija de tama\\u00f1o MAX_BSETS que estaba indexada fuera de los l\\u00edmites para los iteradores de tama\\u00f1o din\\u00e1mico, lo que provoca que UBSAN se queje. Este parche utiliza el mismo enfoque que en sort_iter de bcachefs y divide el iterador en un btree_iter con un miembro de matriz flexible y un btree_iter_stack que incorpora un btree_iter as\\u00ed como una matriz de datos de longitud fija.\"}]",
"id": "CVE-2024-39482",
"lastModified": "2024-11-21T09:27:47.023",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
"published": "2024-07-05T07:15:10.710",
"references": "[{\"url\": \"https://git.kernel.org/stable/c/0c31344e22dd8d6b1394c6e4c41d639015bdc671\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/2c3d7b03b658dc8bfa6112b194b67b92a87e081b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/3a861560ccb35f2a4f0a4b8207fa7c2a35fc7f31\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/5a1922adc5798b7ec894cd3f197afb6f9591b023\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/6479b9f41583b013041943c4602e1ad61cec8148\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/934e1e4331859183a861f396d7dfaf33cb5afb02\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/0c31344e22dd8d6b1394c6e4c41d639015bdc671\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/2c3d7b03b658dc8bfa6112b194b67b92a87e081b\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/3a861560ccb35f2a4f0a4b8207fa7c2a35fc7f31\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/5a1922adc5798b7ec894cd3f197afb6f9591b023\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/6479b9f41583b013041943c4602e1ad61cec8148\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/934e1e4331859183a861f396d7dfaf33cb5afb02\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Patch\"]}]",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-770\"}]}]"
},
"microsoft_vex": {
"current_release_date": "2026-02-18T01:30:09.000Z",
"cve": "CVE-2024-39482",
"id": "msrc_CVE-2024-39482",
"initial_release_date": "2024-07-01T07:00:00.000Z",
"product_status:fixed": "5",
"product_status:known_affected": "5",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "bcache: fix variable length array abuse in btree_iter",
"url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-39482.json",
"version": "13"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2024-39482\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-05T07:15:10.710\",\"lastModified\":\"2026-08-04T11:18:59.110\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbcache: fix variable length array abuse in btree_iter\\n\\nbtree_iter is used in two ways: either allocated on the stack with a\\nfixed size MAX_BSETS, or from a mempool with a dynamic size based on the\\nspecific cache set. Previously, the struct had a fixed-length array of\\nsize MAX_BSETS which was indexed out-of-bounds for the dynamically-sized\\niterators, which causes UBSAN to complain.\\n\\nThis patch uses the same approach as in bcachefs\u0027s sort_iter and splits\\nthe iterator into a btree_iter with a flexible array member and a\\nbtree_iter_stack which embeds a btree_iter as well as a fixed-length\\ndata array.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bcache: corrige el abuso de matriz de longitud variable en btree_iter btree_iter se usa de dos maneras: ya sea asignado en la pila con un tama\u00f1o fijo MAX_BSETS, o desde un mempool con un tama\u00f1o din\u00e1mico basado en el conjunto de cach\u00e9 espec\u00edfico. Anteriormente, la estructura ten\u00eda una matriz de longitud fija de tama\u00f1o MAX_BSETS que estaba indexada fuera de los l\u00edmites para los iteradores de tama\u00f1o din\u00e1mico, lo que provoca que UBSAN se queje. Este parche utiliza el mismo enfoque que en sort_iter de bcachefs y divide el iterador en un btree_iter con un miembro de matriz flexible y un btree_iter_stack que incorpora un btree_iter as\u00ed como una matriz de datos de longitud fija.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/md/bcache/bset.c\",\"drivers/md/bcache/bset.h\",\"drivers/md/bcache/btree.c\",\"drivers/md/bcache/super.c\",\"drivers/md/bcache/sysfs.c\",\"drivers/md/bcache/writeback.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"cafe563591446cf80bfbc2fe3bc72a2e36cf1060\",\"lessThan\":\"2c3d7b03b658dc8bfa6112b194b67b92a87e081b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cafe563591446cf80bfbc2fe3bc72a2e36cf1060\",\"lessThan\":\"5a1922adc5798b7ec894cd3f197afb6f9591b023\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cafe563591446cf80bfbc2fe3bc72a2e36cf1060\",\"lessThan\":\"934e1e4331859183a861f396d7dfaf33cb5afb02\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cafe563591446cf80bfbc2fe3bc72a2e36cf1060\",\"lessThan\":\"6479b9f41583b013041943c4602e1ad61cec8148\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cafe563591446cf80bfbc2fe3bc72a2e36cf1060\",\"lessThan\":\"0c31344e22dd8d6b1394c6e4c41d639015bdc671\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cafe563591446cf80bfbc2fe3bc72a2e36cf1060\",\"lessThan\":\"3a861560ccb35f2a4f0a4b8207fa7c2a35fc7f31\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/md/bcache/bset.c\",\"drivers/md/bcache/bset.h\",\"drivers/md/bcache/btree.c\",\"drivers/md/bcache/super.c\",\"drivers/md/bcache/sysfs.c\",\"drivers/md/bcache/writeback.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.221\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.162\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.94\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.34\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.5\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"RUGGEDCOM RST2428P\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V3.1\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"RUGGEDCOM RST2428P\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"unaffected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"unaffected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"unaffected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SCALANCE XCM-/XRM-/XCH-/XRH-300 family\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V3.1\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SCALANCE XCM-/XRM-/XCH-/XRH-300 family\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"unaffected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-07-08T17:54:07.988323Z\",\"id\":\"CVE-2024-39482\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-770\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10\",\"versionEndExcluding\":\"5.10.221\",\"matchCriteriaId\":\"520E9C39-AB38-4A1C-B857-2030B4982A71\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15\",\"versionEndExcluding\":\"5.15.162\",\"matchCriteriaId\":\"4626E4B7-D5F4-42CC-93A8-B73E6384273F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1\",\"versionEndExcluding\":\"6.1.94\",\"matchCriteriaId\":\"B5A86346-2984-4261-AC12-29EACB186000\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6\",\"versionEndExcluding\":\"6.6.34\",\"matchCriteriaId\":\"AC0C6E24-8240-425A-BD1A-F78E6D3A67FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.9\",\"versionEndExcluding\":\"6.9.5\",\"matchCriteriaId\":\"54EDFD02-25E6-4BC8-9AD0-0A59881F400A\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0c31344e22dd8d6b1394c6e4c41d639015bdc671\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2c3d7b03b658dc8bfa6112b194b67b92a87e081b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3a861560ccb35f2a4f0a4b8207fa7c2a35fc7f31\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5a1922adc5798b7ec894cd3f197afb6f9591b023\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6479b9f41583b013041943c4602e1ad61cec8148\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/934e1e4331859183a861f396d7dfaf33cb5afb02\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0c31344e22dd8d6b1394c6e4c41d639015bdc671\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2c3d7b03b658dc8bfa6112b194b67b92a87e081b\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3a861560ccb35f2a4f0a4b8207fa7c2a35fc7f31\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5a1922adc5798b7ec894cd3f197afb6f9591b023\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6479b9f41583b013041943c4602e1ad61cec8148\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/934e1e4331859183a861f396d7dfaf33cb5afb02\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-265688.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-355557.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-613116.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-08-05T03:46:31+00:00",
"cve": "CVE-2024-39482",
"id": "CVE-2024-39482",
"initial_release_date": "2024-07-05T00:00:00+00:00",
"product_status:known_not_affected": "198",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: bcache: fix variable length array abuse in btree_iter",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-39482.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "moderate",
"current_release_date": "2026-08-05T00:56:32Z",
"cve": "CVE-2024-39482",
"id": "CVE-2024-39482",
"initial_release_date": "2024-07-06T02:58:29Z",
"product_status:known_affected": "442",
"product_status:known_not_affected": "6",
"product_status:recommended": "656",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2024-39482",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-39482.json",
"version": "86"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/2c3d7b03b658dc8bfa6112b194b67b92a87e081b\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/5a1922adc5798b7ec894cd3f197afb6f9591b023\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/934e1e4331859183a861f396d7dfaf33cb5afb02\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/6479b9f41583b013041943c4602e1ad61cec8148\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0c31344e22dd8d6b1394c6e4c41d639015bdc671\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/3a861560ccb35f2a4f0a4b8207fa7c2a35fc7f31\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:26:15.917Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-39482\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-07-08T17:54:07.988323Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-08T17:54:12.398Z\"}}], \"cna\": {\"title\": \"bcache: fix variable length array abuse in btree_iter\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"cafe563591446cf80bfbc2fe3bc72a2e36cf1060\", \"lessThan\": \"2c3d7b03b658dc8bfa6112b194b67b92a87e081b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"cafe563591446cf80bfbc2fe3bc72a2e36cf1060\", \"lessThan\": \"5a1922adc5798b7ec894cd3f197afb6f9591b023\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"cafe563591446cf80bfbc2fe3bc72a2e36cf1060\", \"lessThan\": \"934e1e4331859183a861f396d7dfaf33cb5afb02\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"cafe563591446cf80bfbc2fe3bc72a2e36cf1060\", \"lessThan\": \"6479b9f41583b013041943c4602e1ad61cec8148\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"cafe563591446cf80bfbc2fe3bc72a2e36cf1060\", \"lessThan\": \"0c31344e22dd8d6b1394c6e4c41d639015bdc671\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"cafe563591446cf80bfbc2fe3bc72a2e36cf1060\", \"lessThan\": \"3a861560ccb35f2a4f0a4b8207fa7c2a35fc7f31\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/md/bcache/bset.c\", \"drivers/md/bcache/bset.h\", \"drivers/md/bcache/btree.c\", \"drivers/md/bcache/super.c\", \"drivers/md/bcache/sysfs.c\", \"drivers/md/bcache/writeback.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.10\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.10\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.221\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.162\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.94\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.34\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/md/bcache/bset.c\", \"drivers/md/bcache/bset.h\", \"drivers/md/bcache/btree.c\", \"drivers/md/bcache/super.c\", \"drivers/md/bcache/sysfs.c\", \"drivers/md/bcache/writeback.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/2c3d7b03b658dc8bfa6112b194b67b92a87e081b\"}, {\"url\": \"https://git.kernel.org/stable/c/5a1922adc5798b7ec894cd3f197afb6f9591b023\"}, {\"url\": \"https://git.kernel.org/stable/c/934e1e4331859183a861f396d7dfaf33cb5afb02\"}, {\"url\": \"https://git.kernel.org/stable/c/6479b9f41583b013041943c4602e1ad61cec8148\"}, {\"url\": \"https://git.kernel.org/stable/c/0c31344e22dd8d6b1394c6e4c41d639015bdc671\"}, {\"url\": \"https://git.kernel.org/stable/c/3a861560ccb35f2a4f0a4b8207fa7c2a35fc7f31\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbcache: fix variable length array abuse in btree_iter\\n\\nbtree_iter is used in two ways: either allocated on the stack with a\\nfixed size MAX_BSETS, or from a mempool with a dynamic size based on the\\nspecific cache set. Previously, the struct had a fixed-length array of\\nsize MAX_BSETS which was indexed out-of-bounds for the dynamically-sized\\niterators, which causes UBSAN to complain.\\n\\nThis patch uses the same approach as in bcachefs\u0027s sort_iter and splits\\nthe iterator into a btree_iter with a flexible array member and a\\nbtree_iter_stack which embeds a btree_iter as well as a fixed-length\\ndata array.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.221\", \"versionStartIncluding\": \"3.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.162\", \"versionStartIncluding\": \"3.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.94\", \"versionStartIncluding\": \"3.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.34\", \"versionStartIncluding\": \"3.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.5\", \"versionStartIncluding\": \"3.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"3.10\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:21:24.514Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-39482\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:21:24.514Z\", \"dateReserved\": \"2024-06-25T14:23:23.746Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-05T06:55:10.599Z\", \"assignerShortName\": \"Linux\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
Loading…
Loading…