CyberSecBulletin
CVE-2024-49930NVD status: Modified

Linux: Improper Validation of Array Index

Published Updated By the CyberSecBulletin desk

CVE-2024-49930 is a high-severity improper validation of array index vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 0f26f26944035ec67546a944f182cbad6577a9c0, 4dd732893bd38cec51f887244314e2b47f0d658f, 73e235728e515faccc104b0153b47d0f263b3344 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.38% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 0f26f26944035ec67546a944f182cbad6577a9c0 or 4dd732893bd38cec51f887244314e2b47f0d658f or 73e235728e515faccc104b0153b47d0f263b3344 or 7a552bc2f3efe2aaf77a85cb34cdf4a63d81a1a7, whichever matches your release line, or a later version.
  2. Update SIMATIC S7-1500 TM MFP - GNU/Linux subsystem to V1.1.1 or a later version.
  3. Update Linux Kernel to 5.10.227 or 5.15.168 or 6.1.113 or 6.6.55, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxd5c65159f2895379e11ca13f62feabe93278985d up to, but not including, 0f26f26944035ec67546a944f182cbad6577a9c0; d5c65159f2895379e11ca13f62feabe93278985d up to, but not including, 4dd732893bd38cec51f887244314e2b47f0d658f; d5c65159f2895379e11ca13f62feabe93278985d up to, but not including, 73e235728e515faccc104b0153b47d0f263b3344; d5c65159f2895379e11ca13f62feabe93278985d up to, but not including, 7a552bc2f3efe2aaf77a85cb34cdf4a63d81a1a7; d5c65159f2895379e11ca13f62feabe93278985d up to, but not including, 6045ef5b4b00fee3629689f791992900a1c94009; d5c65159f2895379e11ca13f62feabe93278985d up to, but not including, 01b77f5ee11c89754fb836af8f76799d3b72ae2f; d5c65159f2895379e11ca13f62feabe93278985d up to, but not including, 69f253e46af98af17e3efa3e5dfa72fcb7d1983d; 5.60f26f26944035ec67546a944f182cbad6577a9c0, 4dd732893bd38cec51f887244314e2b47f0d658f, 73e235728e515faccc104b0153b47d0f263b3344, 7a552bc2f3efe2aaf77a85cb34cdf4a63d81a1a7, 6045ef5b4b00fee3629689f791992900a1c94009, 01b77f5ee11c89754fb836af8f76799d3b72ae2f
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystembefore V1.1.1V1.1.1
LinuxLinux Kernelbefore 5.10.227; 5.11 up to, but not including, 5.15.168; 5.16 up to, but not including, 6.1.113; 6.2 up to, but not including, 6.6.55; 6.7 up to, but not including, 6.10.14; 6.11 up to, but not including, 6.11.35.10.227, 5.15.168, 6.1.113, 6.6.55, 6.10.14, 6.11.3

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.18.8HighCNA
CVSS 3.17.8HighNVD

Official description

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix array out-of-bound access in SoC stats Currently, the ath11k_soc_dp_stats::hal_reo_error array is defined with a maximum size of DP_REO_DST_RING_MAX. However, the ath11k_dp_process_rx() function access ath11k_soc_dp_stats::hal_reo_error using the REO destination SRNG ring ID, which is incorrect. SRNG ring ID differ from normal ring ID, and this usage leads to out-of-bounds array access. To fix this issue, modify ath11k_dp_process_rx() to use the normal ring ID directly instead of the SRNG ring ID to avoid out-of-bounds array access. Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Validation of Array Index

The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

How developers prevent this class of flaw

  • Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).
  • Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, Ada allows the programmer to constrain the values of a variable and languages such as Java and Ruby will allow the programmer to handle exceptions when an out-of-bounds index is accessed.
  • Use a CPU and operating system that offers Data Execution Protection (using hardware NX or XD bits) or the equivalent techniques that simulate this feature in software, such as PaX. These techniques ensure that any instruction executed is exclusively at a memory address that is part of the code segment. For more information on these techniques see D3-PSEP (Process Segment Execution Prevention) from D3FEND.

More Improper Validation of Array Index vulnerabilities (CWE-129)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Improper Validation of Array Index vulnerabilities

Spotted an error? Tell us.