CVE-2024-46688— erofs: fix out-of-bound access when z_erofs_gbuf_growsize() partially fails
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-46688
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
erofs: fix out-of-bound access when z_erofs_gbuf_growsize() partially fails
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: erofs: fix out-of-bound access when z_erofs_gbuf_growsize() partially fails If z_erofs_gbuf_growsize() partially fails on a global buffer due to memory allocation failure or fault injection (as reported by syzbot [1]), new pages need to be freed by comparing to the existing pages to avoid memory leaks. However, the old gbuf->pages[] array may not be large enough, which can lead to null-ptr-deref or out-of-bound access. Fix this by checking against gbuf->nrpages in advance. [1] https://lore.kernel.org/r/000000000000f7b96e062018c6e3@google.com
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在z_erofs_gbuf_growsize函数部分失败时未能正确释放新页面，可能导致内存泄漏或越界访问。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-46688
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-46688
请登录查看更多情报信息。
Same Patch Batch · Linux · 2024-09-13 · 40 CVEs total
| CVE-2024-46704 | workqueue: Fix spruious data race in __flush_work() | |
| CVE-2024-46694 | drm/amd/display: avoid using null object of framebuffer | |
| CVE-2024-46696 | nfsd: fix potential UAF in nfsd4_cb_getattr_release | |
| CVE-2024-46695 | selinux,smack: don't bypass permissions check in inode_setsecctx hook | |
| CVE-2024-46698 | video/aperture: optionally match the device in sysfb_disable() | |
| CVE-2024-46697 | nfsd: ensure that nfsd4_fattr_args.context is zeroed out | |
| CVE-2024-46699 | drm/v3d: Disable preemption while updating GPU stats | |
| CVE-2024-46701 | libfs: fix infinite directory reads for offset dir | |
| CVE-2024-46702 | thunderbolt: Mark XDomain as unplugged when router is removed | |
| CVE-2024-46703 | Revert "serial: 8250_omap: Set the console genpd always on if no console suspend" | |
| CVE-2024-46692 | firmware: qcom: scm: Mark get_wq_ctx() as atomic call | |
| CVE-2024-46705 | drm/xe: reset mmio mappings with devm | |
| CVE-2024-46706 | tty: serial: fsl_lpuart: mark last busy before uart_add_one_port | |
| CVE-2024-46707 | KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3 | |
| CVE-2024-46709 | drm/vmwgfx: Fix prime with external buffers | |
| CVE-2024-46708 | pinctrl: qcom: x1e80100: Fix special pin offsets | |
| CVE-2024-46710 | drm/vmwgfx: Prevent unmapping active read buffers | |
| CVE-2024-46711 | mptcp: pm: fix ID 0 endp usage after multiple re-creations | |
| CVE-2024-46712 | drm/vmwgfx: Disable coherent dumb buffers without 3d | |
| CVE-2024-46713 | perf/aux: Fix AUX buffer serialization |
Showing top 20 of 40 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
Same vendor: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
V. Comments for CVE-2024-46688
No comments yet