CVE-2024-36957: octeontx2-af: avoid off-by-one read from userspace
In the Linux kernel, the following vulnerability has been resolved:
octeontx2-af: avoid off-by-one read from userspace
The Linux kernel CVE team has assigned CVE-2024-36957 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024053041-CVE-2024-36957-5919@gregkh/T
Other sources
In the Linux kernel, the following vulnerability has been resolved:
octeontx2-af: avoid off-by-one read from userspace
We try to access count + 1 byte from userspace with memdupuser(buffer, count + 1). However, the userspace only provides buffer of count bytes and only these count bytes are verified to be okay to access. To ensure the copied buffer is NUL terminated, we use memdupusernul instead.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36957?
CVE-2024-36957 is classified as a moderate severity vulnerability due to an off-by-one read in the Linux kernel.
How do I fix CVE-2024-36957?
To mitigate CVE-2024-36957, update the Linux kernel to a version that is not vulnerable, such as 5.10.223-1 or later.
Which versions of the Linux kernel are affected by CVE-2024-36957?
CVE-2024-36957 affects various versions of the Linux kernel including versions up to 5.10.217, 5.15.159, and 6.1.91.
What is the nature of the vulnerability in CVE-2024-36957?
CVE-2024-36957 involves an off-by-one read from userspace in the Linux kernel, which could lead to information disclosure.
Is CVE-2024-36957 present in distributions based on the Linux kernel?
Yes, CVE-2024-36957 could be present in any Linux distribution that runs the affected versions of the kernel.