fkie_nvd - fkie_cve-2024-53681

fkie_cve-2024-53681

Vulnerability from fkie_nvd

Published

2025-01-15 13:15

Modified

2025-01-15 13:15

Severity ?

Summary

In the Linux kernel, the following vulnerability has been resolved: nvmet: Don't overflow subsysnqn nvmet_root_discovery_nqn_store treats the subsysnqn string like a fixed size buffer, even though it is dynamically allocated to the size of the string. Create a new string with kstrndup instead of using the old buffer.

References

▼	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/4db3d750ac7e894278ef1cb1c53cc7d883060496
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/86645d8d062af3fdcbdaa0a289b95de55bca827d

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: Don\u0027t overflow subsysnqn\n\nnvmet_root_discovery_nqn_store treats the subsysnqn string like a fixed\nsize buffer, even though it is dynamically allocated to the size of the\nstring.\n\nCreate a new string with kstrndup instead of using the old buffer."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nvmet: No desborde subsysnqn nvmet_root_discovery_nqn_store trata la cadena subsysnqn como un b\u00fafer de tama\u00f1o fijo, aunque se le asigna din\u00e1micamente el tama\u00f1o de la cadena. Cree una nueva cadena con kstrndup en lugar de usar el b\u00fafer anterior."
    }
  ],
  "id": "CVE-2024-53681",
  "lastModified": "2025-01-15T13:15:10.963",
  "metrics": {},
  "published": "2025-01-15T13:15:10.963",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/4db3d750ac7e894278ef1cb1c53cc7d883060496"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/86645d8d062af3fdcbdaa0a289b95de55bca827d"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Awaiting Analysis"
}

cve-2024-53681

Vulnerability from cvelistv5

Published

2025-01-15 13:10

Modified

2025-01-20 06:21

Severity ?

Summary

References

▼	URL	Tags
	https://git.kernel.org/stable/c/86645d8d062af3fdcbdaa0a289b95de55bca827d
	https://git.kernel.org/stable/c/4db3d750ac7e894278ef1cb1c53cc7d883060496

Impacted products

Vendor

Product

Version

▼

Linux

Version: 95409e277d8343810adf8700d29d4329828d452b
Version: 95409e277d8343810adf8700d29d4329828d452b

Linux

Version: 6.9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/target/configfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "86645d8d062af3fdcbdaa0a289b95de55bca827d",
              "status": "affected",
              "version": "95409e277d8343810adf8700d29d4329828d452b",
              "versionType": "git"
            },
            {
              "lessThan": "4db3d750ac7e894278ef1cb1c53cc7d883060496",
              "status": "affected",
              "version": "95409e277d8343810adf8700d29d4329828d452b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/target/configfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: Don\u0027t overflow subsysnqn\n\nnvmet_root_discovery_nqn_store treats the subsysnqn string like a fixed\nsize buffer, even though it is dynamically allocated to the size of the\nstring.\n\nCreate a new string with kstrndup instead of using the old buffer."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-20T06:21:56.988Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/86645d8d062af3fdcbdaa0a289b95de55bca827d"
        },
        {
          "url": "https://git.kernel.org/stable/c/4db3d750ac7e894278ef1cb1c53cc7d883060496"
        }
      ],
      "title": "nvmet: Don\u0027t overflow subsysnqn",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-53681",
    "datePublished": "2025-01-15T13:10:22.141Z",
    "dateReserved": "2025-01-15T13:08:59.671Z",
    "dateUpdated": "2025-01-20T06:21:56.988Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted