CVE-2024-43845 (GCVE-0-2024-43845)

Vulnerability from cvelistv5 – Published: 2024-08-17 09:21 – Updated: 2026-08-05 11:36
VLAI
Title
udf: Fix bogus checksum computation in udf_rename()
Summary
In the Linux kernel, the following vulnerability has been resolved: udf: Fix bogus checksum computation in udf_rename() Syzbot reports uninitialized memory access in udf_rename() when updating checksum of '..' directory entry of a moved directory. This is indeed true as we pass on-stack diriter.fi to the udf_update_tag() and because that has only struct fileIdentDesc included in it and not the impUse or name fields, the checksumming function is going to checksum random stack contents beyond the end of the structure. This is actually harmless because the following udf_fiiter_write_fi() will recompute the checksum from on-disk buffers where everything is properly included. So all that is needed is just removing the bogus calculation.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 626860c470ff88e5f7f22a282efd1bfe953a1b54 , < 9c439311c13fc6faab1921441165c9b8b500c83b (git)
Affected: e9109a92d2a95889498bed3719cd2318892171a2 , < fe2ead240c31e8d158713beca9d0681a6e6a53ab (git)
Affected: e9109a92d2a95889498bed3719cd2318892171a2 , < 40d7b3ed52449d36143bab8d3e70926aa61a60f4 (git)
Affected: e9109a92d2a95889498bed3719cd2318892171a2 , < 27ab33854873e6fb958cb074681a0107cc2ecc4c (git)
Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 6.6.44 , ≤ 6.6.* (semver)
Unaffected: 6.10.3 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-43845",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:07:43.116457Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:22.040Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/udf/namei.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9c439311c13fc6faab1921441165c9b8b500c83b",
              "status": "affected",
              "version": "626860c470ff88e5f7f22a282efd1bfe953a1b54",
              "versionType": "git"
            },
            {
              "lessThan": "fe2ead240c31e8d158713beca9d0681a6e6a53ab",
              "status": "affected",
              "version": "e9109a92d2a95889498bed3719cd2318892171a2",
              "versionType": "git"
            },
            {
              "lessThan": "40d7b3ed52449d36143bab8d3e70926aa61a60f4",
              "status": "affected",
              "version": "e9109a92d2a95889498bed3719cd2318892171a2",
              "versionType": "git"
            },
            {
              "lessThan": "27ab33854873e6fb958cb074681a0107cc2ecc4c",
              "status": "affected",
              "version": "e9109a92d2a95889498bed3719cd2318892171a2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/udf/namei.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.44",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.3",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: Fix bogus checksum computation in udf_rename()\n\nSyzbot reports uninitialized memory access in udf_rename() when updating\nchecksum of \u0027..\u0027 directory entry of a moved directory. This is indeed\ntrue as we pass on-stack diriter.fi to the udf_update_tag() and because\nthat has only struct fileIdentDesc included in it and not the impUse or\nname fields, the checksumming function is going to checksum random stack\ncontents beyond the end of the structure. This is actually harmless\nbecause the following udf_fiiter_write_fi() will recompute the checksum\nfrom on-disk buffers where everything is properly included. So all that\nis needed is just removing the bogus calculation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Triggering requires a crafted UDF image to be mounted and a local `renameat2()`/`mv` of a directory to a different parent directory; there is no remote or network-facing path into `udf_rename()`. Loop-mounting a crafted image via udisks2 removes any need for physical media access, so Local rather than Physical.\nAC:L - The attacker fully controls the `lengthOfImpUse` field of the `..` file identifier descriptor in their own image and the rename operation itself; the out-of-bounds read length and trigger are deterministic with no race or unknown state involved.\nPR:L - An unprivileged local account suffices \u2014 on typical desktop/kiosk systems udisks2 lets an active local session mount removable or loop-backed UDF media without root, and the `mv` that reaches `udf_rename()` needs only write access to directories inside the attacker\u0027s own image.\nUI:N - A single unprivileged actor performs every step \u2014 supplying the image, getting it mounted through the standard removable-media/loop-mount path, and issuing the rename \u2014 so no separate victim action is needed.\nS:U - The out-of-bounds access stays within the kernel\u0027s own stack and security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `udf_update_tag()` reads up to roughly 4 KB past the 38-byte on-stack `fileIdentDesc` with a length the attacker chooses via `lengthOfImpUse`, covering caller stack frames, saved registers and return addresses \u2014 far beyond a strictly bounded few-byte read.\nI:H - The bug is an attacker-length-controlled memory-safety violation on the kernel stack in the middle of a metadata-update path, consistent with the High integrity rating applied to the same class of crafted-image out-of-bounds access in UDF (e.g. CVE-2025-40044).\nA:H - With a large crafted `lengthOfImpUse`, the CRC loop walks off the top of the 16 KB VMAP_STACK allocation into the guard page, producing an unhandled kernel page fault/oops; the smaller case is a confirmed KMSAN uninitialized-memory report."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:36:43.794Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9c439311c13fc6faab1921441165c9b8b500c83b"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe2ead240c31e8d158713beca9d0681a6e6a53ab"
        },
        {
          "url": "https://git.kernel.org/stable/c/40d7b3ed52449d36143bab8d3e70926aa61a60f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/27ab33854873e6fb958cb074681a0107cc2ecc4c"
        }
      ],
      "title": "udf: Fix bogus checksum computation in udf_rename()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-43845",
    "datePublished": "2024-08-17T09:21:59.735Z",
    "dateReserved": "2024-08-17T09:11:59.275Z",
    "dateUpdated": "2026-08-05T11:36:43.794Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-43845",
      "date": "2026-08-06",
      "epss": "0.00221",
      "percentile": "0.12695"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.3\", \"versionEndExcluding\": \"6.6.44\", \"matchCriteriaId\": \"E752D2D6-EE15-4491-857A-AA8D6AE62EDF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.10.3\", \"matchCriteriaId\": \"92D388F2-1EAF-4CFA-AC06-5B26D762EA7D\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nudf: Fix bogus checksum computation in udf_rename()\\n\\nSyzbot reports uninitialized memory access in udf_rename() when updating\\nchecksum of \u0027..\u0027 directory entry of a moved directory. This is indeed\\ntrue as we pass on-stack diriter.fi to the udf_update_tag() and because\\nthat has only struct fileIdentDesc included in it and not the impUse or\\nname fields, the checksumming function is going to checksum random stack\\ncontents beyond the end of the structure. This is actually harmless\\nbecause the following udf_fiiter_write_fi() will recompute the checksum\\nfrom on-disk buffers where everything is properly included. So all that\\nis needed is just removing the bogus calculation.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: udf: corrige el c\\u00e1lculo falso de la suma de comprobaci\\u00f3n en udf_rename() Syzbot informa acceso a memoria no inicializada en udf_rename() al actualizar la suma de comprobaci\\u00f3n de la entrada del directorio \u0027..\u0027 de un directorio movido. De hecho, esto es cierto cuando pasamos diriter.fi en la pila a udf_update_tag() y debido a que solo tiene la estructura fileIdentDesc incluida y no los campos impUse o nombre, la funci\\u00f3n de suma de verificaci\\u00f3n sumar\\u00e1 los contenidos aleatorios de la pila m\\u00e1s all\\u00e1 del final de la estructura. En realidad, esto es inofensivo porque el siguiente udf_fiiter_write_fi() volver\\u00e1 a calcular la suma de comprobaci\\u00f3n de los b\\u00faferes en el disco donde todo est\\u00e1 incluido correctamente. As\\u00ed que todo lo que se necesita es simplemente eliminar el c\\u00e1lculo falso.\"}]",
      "id": "CVE-2024-43845",
      "lastModified": "2024-10-25T19:51:07.187",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\", \"baseScore\": 3.3, \"baseSeverity\": \"LOW\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 1.4}]}",
      "published": "2024-08-17T10:15:09.837",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/27ab33854873e6fb958cb074681a0107cc2ecc4c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/40d7b3ed52449d36143bab8d3e70926aa61a60f4\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/9c439311c13fc6faab1921441165c9b8b500c83b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/c996b570305e7a6910c2ce4cdcd4c22757ffe241\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/fe2ead240c31e8d158713beca9d0681a6e6a53ab\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-908\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-43845\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-17T10:15:09.837\",\"lastModified\":\"2026-08-04T11:19:53.890\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nudf: Fix bogus checksum computation in udf_rename()\\n\\nSyzbot reports uninitialized memory access in udf_rename() when updating\\nchecksum of \u0027..\u0027 directory entry of a moved directory. This is indeed\\ntrue as we pass on-stack diriter.fi to the udf_update_tag() and because\\nthat has only struct fileIdentDesc included in it and not the impUse or\\nname fields, the checksumming function is going to checksum random stack\\ncontents beyond the end of the structure. This is actually harmless\\nbecause the following udf_fiiter_write_fi() will recompute the checksum\\nfrom on-disk buffers where everything is properly included. So all that\\nis needed is just removing the bogus calculation.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: udf: corrige el c\u00e1lculo falso de la suma de comprobaci\u00f3n en udf_rename() Syzbot informa acceso a memoria no inicializada en udf_rename() al actualizar la suma de comprobaci\u00f3n de la entrada del directorio \u0027..\u0027 de un directorio movido. De hecho, esto es cierto cuando pasamos diriter.fi en la pila a udf_update_tag() y debido a que solo tiene la estructura fileIdentDesc incluida y no los campos impUse o nombre, la funci\u00f3n de suma de verificaci\u00f3n sumar\u00e1 los contenidos aleatorios de la pila m\u00e1s all\u00e1 del final de la estructura. En realidad, esto es inofensivo porque el siguiente udf_fiiter_write_fi() volver\u00e1 a calcular la suma de comprobaci\u00f3n de los b\u00faferes en el disco donde todo est\u00e1 incluido correctamente. As\u00ed que todo lo que se necesita es simplemente eliminar el c\u00e1lculo falso.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/udf/namei.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"626860c470ff88e5f7f22a282efd1bfe953a1b54\",\"lessThan\":\"9c439311c13fc6faab1921441165c9b8b500c83b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e9109a92d2a95889498bed3719cd2318892171a2\",\"lessThan\":\"fe2ead240c31e8d158713beca9d0681a6e6a53ab\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e9109a92d2a95889498bed3719cd2318892171a2\",\"lessThan\":\"40d7b3ed52449d36143bab8d3e70926aa61a60f4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e9109a92d2a95889498bed3719cd2318892171a2\",\"lessThan\":\"27ab33854873e6fb958cb074681a0107cc2ecc4c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/udf/namei.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.44\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.3\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\",\"baseScore\":3.3,\"baseSeverity\":\"LOW\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.8,\"impactScore\":1.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T16:07:43.116457Z\",\"id\":\"CVE-2024-43845\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-908\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.3\",\"versionEndExcluding\":\"6.6.44\",\"matchCriteriaId\":\"E752D2D6-EE15-4491-857A-AA8D6AE62EDF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.3\",\"matchCriteriaId\":\"92D388F2-1EAF-4CFA-AC06-5B26D762EA7D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/27ab33854873e6fb958cb074681a0107cc2ecc4c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/40d7b3ed52449d36143bab8d3e70926aa61a60f4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9c439311c13fc6faab1921441165c9b8b500c83b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fe2ead240c31e8d158713beca9d0681a6e6a53ab\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:41:57+00:00",
      "cve": "CVE-2024-43845",
      "id": "CVE-2024-43845",
      "initial_release_date": "2024-08-17T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: udf: Fix bogus checksum computation in udf_rename()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-43845.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-23T02:01:27Z",
      "cve": "CVE-2024-43845",
      "id": "CVE-2024-43845",
      "initial_release_date": "2024-08-18T02:01:33Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "339",
      "product_status:recommended": "349",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-43845",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-43845.json",
      "version": "58"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-43845\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:07:43.116457Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:23.012Z\"}}], \"cna\": {\"title\": \"udf: Fix bogus checksum computation in udf_rename()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"626860c470ff88e5f7f22a282efd1bfe953a1b54\", \"lessThan\": \"9c439311c13fc6faab1921441165c9b8b500c83b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e9109a92d2a95889498bed3719cd2318892171a2\", \"lessThan\": \"fe2ead240c31e8d158713beca9d0681a6e6a53ab\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e9109a92d2a95889498bed3719cd2318892171a2\", \"lessThan\": \"40d7b3ed52449d36143bab8d3e70926aa61a60f4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e9109a92d2a95889498bed3719cd2318892171a2\", \"lessThan\": \"27ab33854873e6fb958cb074681a0107cc2ecc4c\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/udf/namei.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.3\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.3\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.44\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/udf/namei.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/9c439311c13fc6faab1921441165c9b8b500c83b\"}, {\"url\": \"https://git.kernel.org/stable/c/fe2ead240c31e8d158713beca9d0681a6e6a53ab\"}, {\"url\": \"https://git.kernel.org/stable/c/40d7b3ed52449d36143bab8d3e70926aa61a60f4\"}, {\"url\": \"https://git.kernel.org/stable/c/27ab33854873e6fb958cb074681a0107cc2ecc4c\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nudf: Fix bogus checksum computation in udf_rename()\\n\\nSyzbot reports uninitialized memory access in udf_rename() when updating\\nchecksum of \u0027..\u0027 directory entry of a moved directory. This is indeed\\ntrue as we pass on-stack diriter.fi to the udf_update_tag() and because\\nthat has only struct fileIdentDesc included in it and not the impUse or\\nname fields, the checksumming function is going to checksum random stack\\ncontents beyond the end of the structure. This is actually harmless\\nbecause the following udf_fiiter_write_fi() will recompute the checksum\\nfrom on-disk buffers where everything is properly included. So all that\\nis needed is just removing the bogus calculation.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.44\", \"versionStartIncluding\": \"6.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.3\", \"versionStartIncluding\": \"6.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"6.3\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-04T09:29:51.408Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-43845\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-04T09:29:51.408Z\", \"dateReserved\": \"2024-08-17T09:11:59.275Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-17T09:21:59.735Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.