CVE-2024-26791— btrfs: dev-replace: properly validate device names
Possible ATT&CK Techniques 1AI
T1203 · Exploitation for Client ExecutionAffected Version Matrix 18
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | e93c89c1aaaaaec3487c4c18dd02360371790722< 11d7a2e429c02d51e2dc90713823ea8b8d3d3a84 | affected |
e93c89c1aaaaaec3487c4c18dd02360371790722< c6652e20d7d783d060fe5f987eac7b5cabe31311 | affected | ||
e93c89c1aaaaaec3487c4c18dd02360371790722< 2886fe308a83968dde252302884a1e63351cf16d | affected | ||
e93c89c1aaaaaec3487c4c18dd02360371790722< ab2d68655d0f04650bef09fee948ff80597c5fb9 | affected | ||
e93c89c1aaaaaec3487c4c18dd02360371790722< f590040ce2b712177306b03c2a63b16f7d48d3c8 | affected | ||
e93c89c1aaaaaec3487c4c18dd02360371790722< b1690ced4d2d8b28868811fb81cd33eee5aefee1 | affected | ||
e93c89c1aaaaaec3487c4c18dd02360371790722< 343eecb4ff49a7b1cc1dfe86958a805cf2341cfb | affected | ||
e93c89c1aaaaaec3487c4c18dd02360371790722< 9845664b9ee47ce7ee7ea93caf47d39a9d4552c4 | affected | ||
| … +10 more rows | |||
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-26791
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
btrfs: dev-replace: properly validate device names
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: btrfs: dev-replace: properly validate device names There's a syzbot report that device name buffers passed to device replace are not properly checked for string termination which could lead to a read out of bounds in getname_kernel(). Add a helper that validates both source and target device name buffers. For devid as the source initialize the buffer to empty string in case something tries to read it later. This was originally analyzed and fixed in a different way by Edward Adam Davis (see links).
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于btrfs dev-replace未正确验证设备名称，可能会导致越界读取。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-26791
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-26791
请登录查看更多情报信息。
Mailing List Discussions for CVE-2024-26791 (2)
Other References for CVE-2024-26791 (8)
Same Patch Batch · Linux · 2024-04-04 · 32 CVEs total
| CVE-2024-26793 | gtp: fix use-after-free and null-ptr-deref in gtp_newlink() | |
| CVE-2024-26809 | netfilter: nft_set_pipapo: release elements in clone only from destroy path | |
| CVE-2024-26808 | netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain | |
| CVE-2024-26807 | spi: cadence-qspi: fix pointer reference in runtime PM hooks | |
| CVE-2024-26806 | spi: cadence-qspi: remove system-wide suspend helper calls from runtime PM hooks | |
| CVE-2024-26805 | netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter | |
| CVE-2024-26804 | net: ip_tunnel: prevent perpetual headroom growth | |
| CVE-2024-26803 | net: veth: clear GRO when clearing XDP even when down | |
| CVE-2024-26802 | stmmac: Clear variable when destroying workqueue | |
| CVE-2024-26800 | tls: fix use-after-free on failed backlog decryption | |
| CVE-2024-26801 | Bluetooth: Avoid potential use-after-free in hci_error_reset | |
| CVE-2024-26799 | ASoC: qcom: Fix uninitialized pointer dmactl | |
| CVE-2024-26798 | fbcon: always restore the old font data in fbcon_do_set_font() | |
| CVE-2024-26797 | drm/amd/display: Prevent potential buffer overflow in map_hw_resources | |
| CVE-2024-26796 | drivers: perf: ctr_get_width function for legacy is not defined | |
| CVE-2024-26795 | riscv: Sparse-Memory/vmemmap out-of-bounds fix | |
| CVE-2024-26745 | powerpc/pseries/iommu: IOMMU table is not initialized for kdump over SR-IOV | |
| CVE-2024-26792 | btrfs: fix double free of anonymous device after snapshot creation failure | |
| CVE-2024-26790 | dmaengine: fsl-qdma: fix SoC may hang on 16 byte unaligned read | |
| CVE-2024-26789 | crypto: arm64/neonbs - fix out-of-bounds access on short input |
Showing top 20 of 32 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2024-14040
net: nexthop: Increase weight to u16 - CVE-2026-64530
net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_han - CVE-2026-64529
crypto: qat - remove unused character device and IOCTLs - CVE-2026-64528
tty: serial: samsung: Remove redundant port lock acquisition - CVE-2026-64527
drm/hyperv: validate VMBus packet size in receive callback
Same vendor: Linux
- CVE-2024-14040
net: nexthop: Increase weight to u16 - CVE-2026-64530
net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_han - CVE-2026-64529
crypto: qat - remove unused character device and IOCTLs - CVE-2026-64528
tty: serial: samsung: Remove redundant port lock acquisition - CVE-2026-64527
drm/hyperv: validate VMBus packet size in receive callback
V. Comments for CVE-2024-26791
No comments yet