CVE-2024-42257

HIGH EPSS 10.2%
Published Aug 8, 20241y ago · Modified Jun 17, 20262w ago
7.8 CVSS 3.1
High
Find Similar
Published Aug 8, 2024 1y ago
Last Modified Jun 17, 2026 2w ago

Description

In the Linux kernel, the following vulnerability has been resolved: ext4: use memtostr_pad() for s_volume_name As with the other strings in struct ext4_super_block, s_volume_name is not NUL terminated. The other strings were marked in commit 072ebb3bffe6 ("ext4: add nonstring annotations to ext4.h"). Using strscpy() isn't the right replacement for strncpy(); it should use memtostr_pad() instead.

CVSS Details

Base Score
7.8
Exploitability
1.8
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
10.2% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Affected Products 1

VendorProductVersionRange
linuxlinux_kernel*≥6.10  –  <6.10.1

References 2

  • git.kernel.org https://git.kernel.org/stable/c/4378be89ddb7de88d984b67ecfd6191686c42817
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/be27cd64461c45a6088a91a04eba5cd44e1767ef
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/4378be89ddb7de88d984b67ecfd6191686c42817
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/be27cd64461c45a6088a91a04eba5cd44e1767ef
    Patch