CyberSecBulletin
CVE-2024-26995NVD status: Modified

Linux: Off-by-one Error

Published Updated By the CyberSecBulletin desk

CVE-2024-26995 is a high-severity off-by-one error vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions f3da3192cdd3fefe213390e976eec424a8e270b5, c4128304c2169b4664ed6fb6200f228cead2ab70 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.24% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to f3da3192cdd3fefe213390e976eec424a8e270b5 or c4128304c2169b4664ed6fb6200f228cead2ab70, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 6.8.8 or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxcd099cde4ed264403b434d8344994f97ac2a4349 up to, but not including, f3da3192cdd3fefe213390e976eec424a8e270b5; cd099cde4ed264403b434d8344994f97ac2a4349 up to, but not including, c4128304c2169b4664ed6fb6200f228cead2ab70; 6.8f3da3192cdd3fefe213390e976eec424a8e270b5, c4128304c2169b4664ed6fb6200f228cead2ab70
LinuxLinux Kernel6.8 up to, but not including, 6.8.8; 6.96.8.8

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Official description

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: Correct the PDO counting in pd_set Off-by-one errors happen because nr_snk_pdo and nr_src_pdo are incorrectly added one. The index of the loop is equal to the number of PDOs to be updated when leaving the loop and it doesn't need to be added one. When doing the power negotiation, TCPM relies on the "nr_snk_pdo" as the size of the local sink PDO array to match the Source capabilities of the partner port. If the off-by-one overflow occurs, a wrong RDO might be sent and unexpected power transfer might happen such as over voltage or over current (than expected). "nr_src_pdo" is used to set the Rp level when the port is in Source role. It is also the array size of the local Source capabilities when filling up the buffer which will be sent as the Source PDOs (such as in Power Negotiation). If the off-by-one overflow occurs, a wrong Rp level might be set and wrong Source PDOs will be sent to the partner port. This could potentially cause over current or port resets.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Off-by-one Error

A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

How developers prevent this class of flaw

  • When copying character arrays or using character manipulation methods, the correct size parameter must be used to account for the null terminator that needs to be added at the end of the array. Some examples of functions susceptible to this weakness in C include strcpy(), strncpy(), strcat(), strncat(), printf(), sprintf(), scanf() and sscanf().

More Off-by-one Error vulnerabilities (CWE-193)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Off-by-one Error vulnerabilities

Spotted an error? Tell us.