CVE-2024-47682: scsi: sd: Fix off-by-one error in sd_read_block_characteristics()
In the Linux kernel, the following vulnerability has been resolved:
scsi: sd: Fix off-by-one error in sdreadblockcharacteristics()
Ff the device returns page 0xb1 with length 8 (happens with qemu v2.x, for example), sdreadblockcharacteristics() may attempt an out-of-bounds memory access when accessing the zoned field at offset 8.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47682?
CVE-2024-47682 has a significant severity level due to the potential for an out-of-bounds read that can lead to security issues.
How do I fix CVE-2024-47682?
To fix CVE-2024-47682, update your Linux kernel to a version that includes the patch for this vulnerability.
What versions of the Linux kernel are affected by CVE-2024-47682?
CVE-2024-47682 affects Linux kernel versions between 5.19 and 6.1.113, from 6.2 to 6.6.54, from 6.7 to 6.10.13, and 6.11 to 6.11.2.
What types of systems are impacted by CVE-2024-47682?
Systems running affected versions of the Linux kernel, particularly those utilizing SCSI devices, are impacted by CVE-2024-47682.
Is CVE-2024-47682 related to any specific software or platforms?
CVE-2024-47682 is related to the Linux kernel and may affect virtual environments running on QEMU and similar platforms.