Linux: Out-of-bounds Write
CVE-2024-27036 is a high-severity out-of-bounds write vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions e45deec35bf7f1f4f992a707b2d04a8c162f2240, 65f2ced695982ccd516196d0a9447d85dbe2eed5, 844b4e132f57f1333dc79feaa035075a096762e4 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.28% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to e45deec35bf7f1f4f992a707b2d04a8c162f2240 or 65f2ced695982ccd516196d0a9447d85dbe2eed5 or 844b4e132f57f1333dc79feaa035075a096762e4 or f3dc1bdb6b0b0693562c7c54a6c28bafa608ba3c, whichever matches your release line, or a later version.
- Update Linux Kernel to 6.6.23 or 6.7.11 or 6.8.2, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | d08089f649a0cfb2099c8551ac47eef0cc23fdf2 up to, but not including, e45deec35bf7f1f4f992a707b2d04a8c162f2240; d08089f649a0cfb2099c8551ac47eef0cc23fdf2 up to, but not including, 65f2ced695982ccd516196d0a9447d85dbe2eed5; d08089f649a0cfb2099c8551ac47eef0cc23fdf2 up to, but not including, 844b4e132f57f1333dc79feaa035075a096762e4; d08089f649a0cfb2099c8551ac47eef0cc23fdf2 up to, but not including, f3dc1bdb6b0b0693562c7c54a6c28bafa608ba3c; 6.3 | e45deec35bf7f1f4f992a707b2d04a8c162f2240, 65f2ced695982ccd516196d0a9447d85dbe2eed5, 844b4e132f57f1333dc79feaa035075a096762e4, f3dc1bdb6b0b0693562c7c54a6c28bafa608ba3c |
| Linux | Linux Kernel | 6.3 up to, but not including, 6.6.23; 6.7 up to, but not including, 6.7.11; 6.8 up to, but not including, 6.8.2 | 6.6.23, 6.7.11, 6.8.2 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.
Official description
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix writeback data corruption cifs writeback doesn't correctly handle the case where cifs_extend_writeback() hits a point where it is considering an additional folio, but this would overrun the wsize - at which point it drops out of the xarray scanning loop and calls xas_pause(). The problem is that xas_pause() advances the loop counter - thereby skipping that page. What needs to happen is for xas_reset() to be called any time we decide we don't want to process the page we're looking at, but rather send the request we are building and start a new one. Fix this by copying and adapting the netfslib writepages code as a temporary measure, with cifs writeback intending to be offloaded to netfslib in the near future. This also fixes the issue with the use of filemap_get_folios_tag() causing retry of a bunch of pages which the extender already dealt with. This can be tested by creating, say, a 64K file somewhere not on cifs (otherwise copy-offload may get underfoot), mounting a cifs share with a wsize of 64000, copying the file to it and then comparing the original file and the copy: dd if=/dev/urandom of=/tmp/64K bs=64k count=1 mount //192.168.6.1/test /mnt -o user=...,pass=...,wsize=64000 cp /tmp/64K /mnt/64K cmp /tmp/64K /mnt/64K Without the fix, the cmp fails at position 64000 (or shortly thereafter).
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
How developers prevent this class of flaw
- Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, many languages that perform their own memory management, such as Java and Perl, are not subject to buffer overflows. Other languages, such as Ada and C#, typically provide overflow protection, but the protection can be disabled by the programmer. Be wary that a language's interface to native code may still be subject to overflows, even if the language itself is theoretically safe.
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Examples include the Safe C String Library (SafeStr) by Messier and Viega, and the Strsafe.h library from Microsoft. These libraries provide safer versions of overflow-prone string-handling functions.
- Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking. D3-SFCV (Stack Frame Canary Validation) from D3FEND discusses canary-based detection in detail.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
Recent Out-of-bounds Write vulnerabilities
- 7.5 High severity
- 9.8 Critical severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
Spotted an error? Tell us.