CVE-2024-50143: udf: fix uninit-value use in udf_get_fileshortad
In the Linux kernel, the following vulnerability has been resolved:
udf: fix uninit-value use in udfgetfileshortad
Check for overflow when computing alen in udfcurrentaext to mitigate later uninit-value use in udfgetfileshortad KMSAN bug[1]. After applying the patch reproducer did not trigger any issue[2].
[1] <a href="https://syzkaller.appspot.com/bug?extid=8901c4560b7ab5c2f9df">https://syzkaller.appspot.com/bug?extid=8901c4560b7ab5c2f9df</a> [2] <a href="https://syzkaller.appspot.com/x/log.txt?x=10242227980000">https://syzkaller.appspot.com/x/log.txt?x=10242227980000</a>
Other sources
In the Linux kernel, the following vulnerability has been resolved:
udf: fix uninit-value use in udfgetfileshortad
Check for overflow when computing alen in udfcurrentaext to mitigate later uninit-value use in udfgetfileshortad KMSAN bug[1]. After applying the patch reproducer did not trigger any issue[2].
[1] https://syzkaller.appspot.com/bug?extid=8901c4560b7ab5c2f9df [2] https://syzkaller.appspot.com/x/log.txt?x=10242227980000
— NVD
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50143?
The severity of CVE-2024-50143 has not been officially rated but it involves uninitialized value usage in the Linux kernel which may lead to security issues.
How do I fix CVE-2024-50143?
To fix CVE-2024-50143, apply the latest patches provided by your Linux distribution that include the resolution for the vulnerability.
Which Linux kernel versions are affected by CVE-2024-50143?
CVE-2024-50143 affects various versions of the Linux kernel from 4.20 up to 6.12-rc1.
What type of vulnerability is CVE-2024-50143?
CVE-2024-50143 is related to the use of uninitialized values in the udf_get_fileshortad function within the Linux kernel.
Is there a workaround for CVE-2024-50143?
There are no documented workarounds for CVE-2024-50143 other than applying the security patch.