Out-of-Bounds Memory Access in Linux Kernel - CVE-2024-47695
Summary
CVE-2024-47695: In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds In the function init_conns(), after the create_con() and create_cm() for loop if something fai... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is known for its stability, performance, and security features. However, like any complex software, it is susceptible to vulnerabilities. CVE-2024-47695 specifically affects the RDMA/rtrs-clt component, which is responsible for remote direct memory access connections. This vulnerability arises from improper handling of connection identifiers, leading to potential out-of-bounds memory access.
Vulnerability Detail
CVE-2024-47695 is a vulnerability in the Linux kernel that occurs in the init_conns() function of the RDMA/rtrs-clt component. When the create_con() and create_cm() functions fail during a loop, the cleanup process accesses memory out of bounds because the connection identifier (cid) is incorrectly set to clt_path->s.con_num. This can lead to undefined behavior, including crashes or potential exploitation by attackers to manipulate memory, which may compromise system integrity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to monitor the system for any unusual behavior and apply the patch as soon as it becomes available.
Conclusion
CVE-2024-47695 is a critical vulnerability in the Linux kernel that poses risks of out-of-bounds memory access. It is essential for users to update their systems to the patched version to mitigate potential threats. Monitoring tools like Vulert can assist in identifying vulnerabilities in your software without requiring code access.
See every vulnerability recorded for linux →
FAQ
CVE-2024-47695 is a vulnerability in the Linux kernel that allows for out-of-bounds memory access in the RDMA/rtrs-clt component.
This vulnerability can lead to system crashes or allow attackers to exploit memory, potentially compromising system integrity.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Check your application against CVE-2024-47695 using the Vulert playground without any signup.
While there are no specific workarounds, it is crucial to monitor your system for any unusual activities and apply the patch as soon as possible.
Detailed information can be found on the official CVE database or through security advisories related to the Linux kernel.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
