Out-of-Bounds Access Vulnerability in Linux Kernel's Bcache Package
Summary
CVE-2024-39482: In the Linux kernel, the following vulnerability has been resolved: bcache: fix variable length array abuse in btree_iter btree_iter is used in two ways: either allocated on the stack with a fixed size MAX_BSETS, or from... Affects linux versions < 5.10.221-1. Fixed in 5.10.221-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interactions. Bcache is a caching layer for block devices, designed to improve performance by using fast storage as a cache for slower devices. This vulnerability affects the btree_iter structure used in bcache, which can lead to potential out-of-bounds access and undefined behavior.
Vulnerability Detail
In the Linux kernel, specifically within the bcache implementation, there exists a vulnerability related to the btree_iter structure. This structure was previously defined with a fixed-length array of size MAX_BSETS, which could lead to out-of-bounds access when used with dynamically-sized iterators. This flaw can trigger Undefined Behavior Sanitizer (UBSAN) warnings and may compromise system stability or security. The vulnerability has been identified as CVE-2024-39482 and affects multiple Debian versions of the Linux package.
How To Fix
Minimum fixed version
5.10.221-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the necessary updates as mentioned in the 'how_to_fix' section.
Conclusion
CVE-2024-39482 is a significant vulnerability in the Linux kernel's bcache implementation that can lead to out-of-bounds access. Users are strongly advised to update their systems to the latest versions to mitigate any potential risks associated with this vulnerability.
See every vulnerability recorded for linux →
FAQ
CVE-2024-39482 is a vulnerability in the Linux kernel's bcache implementation that can lead to out-of-bounds access due to improper handling of the btree_iter structure.
This vulnerability can cause undefined behavior, potentially leading to system crashes, data corruption, or security breaches.
The vulnerability affects Debian versions 11, 12, and 13 of the Linux kernel, specifically prior to the fixed versions: 5.10.221-1, 6.1.94-1, and 6.9.7-1 respectively.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
The CVSS score for CVE-2024-39482 is 5.5, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
