CVE-2024-26828: Vulnerability in linux-libc-dev package - Underflow in parse_server_interfaces()
Summary
CVE-2024-26828: In the Linux kernel, the following vulnerability has been resolved: cifs: fix underflow in parse_server_interfaces() In this loop, we step through the buffer and after each item we check if the size_left is greater than... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux-libc-dev package is a development package that provides the necessary header files and libraries for compiling C programs that use the Linux kernel interfaces. It is an essential component for building and linking applications with the Linux kernel. The package is widely used in various Linux distributions.
The vulnerability identified as CVE-2024-26828 affects the linux-libc-dev package. It is related to an underflow issue in the parse_server_interfaces() function within the kernel's cifs module. This vulnerability could potentially be exploited by an attacker to cause a denial-of-service (DoS) condition or execute arbitrary code on a vulnerable system.
Vulnerability Detail
The vulnerability arises from a type mismatch between the 'bytes_left' variable of type ssize_t and the result of the sizeof() function, which is of type size_t. Due to type promotion, if 'bytes_left' becomes negative, the loop in parse_server_interfaces() continues instead of ending. This can lead to an underflow condition, potentially resulting in memory corruption or other unexpected behavior.
An attacker who can control the input to the affected function could exploit this vulnerability to trigger the underflow and potentially execute arbitrary code or crash the system.
The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 6.7, indicating a medium severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the provided fix by updating the linux-libc-dev package to a patched version.
Conclusion
The linux-libc-dev package is vulnerable to an underflow issue in the parse_server_interfaces() function within the cifs module of the Linux kernel. This vulnerability could potentially allow an attacker to execute arbitrary code or cause a denial-of-service condition. It is crucial to update the linux-libc-dev package to a patched version to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
The linux-libc-dev package provides header files and libraries for compiling C programs that use the Linux kernel interfaces. It is an essential component for building and linking applications with the Linux kernel.
This vulnerability could potentially be exploited by an attacker to cause a denial-of-service (DoS) condition or execute arbitrary code on a vulnerable system.
To fix this vulnerability, it is recommended to update the linux-libc-dev package to a version that includes the necessary patch. The package maintainers have released a fixed version that addresses this issue.
There is no known workaround for this vulnerability. It is recommended to apply the provided fix by updating the linux-libc-dev package to a patched version.
The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 6.7, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
