Linux: Off-by-one Error
CVE-2024-56663 is a high-severity off-by-one error vulnerability in Linux, with a CVSS 3.1 base score of 7.1 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 29e640ae641b9f5ffc666049426d2b16c98d9963, f3412522f78826fef1dfae40ef378a863df2591c, f850d1d9f1106f528dfc5807565f2d1fa9a397d3 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.23% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 29e640ae641b9f5ffc666049426d2b16c98d9963 or f3412522f78826fef1dfae40ef378a863df2591c or f850d1d9f1106f528dfc5807565f2d1fa9a397d3 or 2e3dbf938656986cce73ac4083500d0bcfbffe24, whichever matches your release line, or a later version.
- Update Linux Kernel to 5.20 or 6.1.121 or 6.6.67 or 6.12.6, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 7b0a0e3c3a88260b6fcb017e49f198463aa62ed1 up to, but not including, 29e640ae641b9f5ffc666049426d2b16c98d9963; 7b0a0e3c3a88260b6fcb017e49f198463aa62ed1 up to, but not including, f3412522f78826fef1dfae40ef378a863df2591c; 7b0a0e3c3a88260b6fcb017e49f198463aa62ed1 up to, but not including, f850d1d9f1106f528dfc5807565f2d1fa9a397d3; 7b0a0e3c3a88260b6fcb017e49f198463aa62ed1 up to, but not including, 2e3dbf938656986cce73ac4083500d0bcfbffe24; 7a53ad13c09150076b7ddde96c2dfc5622c90b45; 5.19.2 up to, but not including, 5.20; 6.0 | 29e640ae641b9f5ffc666049426d2b16c98d9963, f3412522f78826fef1dfae40ef378a863df2591c, f850d1d9f1106f528dfc5807565f2d1fa9a397d3, 2e3dbf938656986cce73ac4083500d0bcfbffe24, 5.20 |
| Linux | Linux Kernel | 5.19.2 up to, but not including, 5.20; 6.0 up to, but not including, 6.1.121; 6.2 up to, but not including, 6.6.67; 6.7 up to, but not including, 6.12.6; 6.13 | 5.20, 6.1.121, 6.6.67, 6.12.6 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- NoneNothing can be modified.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 7.8 | High | CNA |
| CVSS 3.1 | 7.1 | High | NVD |
| CVSS 3.1 | 7.1 | High | CISA (ADP) |
Official description
In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one Since the netlink attribute range validation provides inclusive checking, the *max* of attribute NL80211_ATTR_MLO_LINK_ID should be IEEE80211_MLD_MAX_NUM_LINKS - 1 otherwise causing an off-by-one. One crash stack for demonstration: ================================================================== BUG: KASAN: wild-memory-access in ieee80211_tx_control_port+0x3b6/0xca0 net/mac80211/tx.c:5939 Read of size 6 at addr 001102080000000c by task fuzzer.386/9508 CPU: 1 PID: 9508 Comm: syz.1.386 Not tainted 6.1.70 #2 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x177/0x231 lib/dump_stack.c:106 print_report+0xe0/0x750 mm/kasan/report.c:398 kasan_report+0x139/0x170 mm/kasan/report.c:495 kasan_check_range+0x287/0x290 mm/kasan/generic.c:189 memcpy+0x25/0x60 mm/kasan/shadow.c:65 ieee80211_tx_control_port+0x3b6/0xca0 net/mac80211/tx.c:5939 rdev_tx_control_port net/wireless/rdev-ops.h:761 [inline] nl80211_tx_control_port+0x7b3/0xc40 net/wireless/nl80211.c:15453 genl_family_rcv_msg_doit+0x22e/0x320 net/netlink/genetlink.c:756 genl_family_rcv_msg net/netlink/genetlink.c:833 [inline] genl_rcv_msg+0x539/0x740 net/netlink/genetlink.c:850 netlink_rcv_skb+0x1de/0x420 net/netlink/af_netlink.c:2508 genl_rcv+0x24/0x40 net/netlink/genetlink.c:861 netlink_unicast_kernel net/netlink/af_netlink.c:1326 [inline] netlink_unicast+0x74b/0x8c0 net/netlink/af_netlink.c:1352 netlink_sendmsg+0x882/0xb90 net/netlink/af_netlink.c:1874 sock_sendmsg_nosec net/socket.c:716 [inline] __sock_sendmsg net/socket.c:728 [inline] ____sys_sendmsg+0x5cc/0x8f0 net/socket.c:2499 ___sys_sendmsg+0x21c/0x290 net/socket.c:2553 __sys_sendmsg net/socket.c:2582 [inline] __do_sys_sendmsg net/socket.c:2591 [inline] __se_sys_sendmsg+0x19e/0x270 net/socket.c:2589 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x45/0x90 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x63/0xcd Update the policy to ensure correct validation.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Off-by-one Error
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
How developers prevent this class of flaw
- When copying character arrays or using character manipulation methods, the correct size parameter must be used to account for the null terminator that needs to be added at the end of the array. Some examples of functions susceptible to this weakness in C include strcpy(), strncpy(), strcat(), strncat(), printf(), sprintf(), scanf() and sscanf().
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
Other references
Recent Off-by-one Error vulnerabilities
- 9.8 Critical severity
- 7.8 High severity
- 7.1 High severity
- 7.1 High severity
- 7.8 High severity
- 7.8 High severity
Spotted an error? Tell us.