CVE-2024-38578

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: Fix buffer size for tag 66 packet The 'TAG 66 Packet Format' description is missing the cipher code and checksum fields that are packed into the message packet. As a result, the buffer allocated for the packet is 3 bytes too small and write_tag_66_packet() will write up to 3 bytes past the end of the buffer. Fix this by increasing the size of the allocation so the whole packet will always fit in the buffer. This fixes the below kasan slab-out-of-bounds bug: BUG: KASAN: slab-out-of-bounds in ecryptfs_generate_key_p...

Affected product and versions

Product

Linux Linux, RUGGEDCOM RST2428P, SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family

Affected versions

>= dddfa461fc8951f9b5f951c13565b6cac678635a < 1c125b9287e58f364d82174efb167414b92b11f1, >= dddfa461fc8951f9b5f951c13565b6cac678635a < 235b85981051cd68fc215fd32a81c6f116bfc4df, >= dddfa461fc8951f9b5f951c13565b6cac678635a < edbfc42ab080e78c6907d40a42c9d10b69e445c1, >= dddfa461fc8951f9b5f951c13565b6cac678635a < 12db25a54ce6bb22b0af28010fff53ef9cb3fe93, >= dddfa461fc8951f9b5f951c13565b6cac678635a < 0d0f8ba042af16519f1ef7dd10463a33b21b677c, >= dddfa461fc8951f9b5f951c13565b6cac678635a < 2ed750b7ae1b5dc72896d7dd114c419afd3d1910, >= dddfa461fc8951f9b5f951c13565b6cac678635a < a20f09452e2f58f761d11ad7b96b5c894c91030e, >= dddfa461fc8951f9b5f951c13565b6cac678635a < f6008487f1eeb8693f8d2a36a89c87d9122ddf74, >= dddfa461fc8951f9b5f951c13565b6cac678635a < 85a6a1aff08ec9f5b929d345d066e2830e8818e5, >= 2.6.21, < V3.1, >= 2.6.21 < 4.19.316, >= 4.20 < 5.4.278, >= 5.5 < 5.10.219, >= 5.11 < 5.15.161, >= 5.16 < 6.1.93, >= 6.2 < 6.6.33, >= 6.7 < 6.8.12, >= 6.9 < 6.9.3

Fixed versions

4.19.316, 5.4.278, 5.10.219, 5.15.161, 6.1.93, 6.6.33, 6.8.12, 6.9.3

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-787