Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-50074

In the Linux kernel, the following vulnerability has been resolved: parport: Proper fix for array out-of-bounds access The recent fix for array out-of-bounds accesses replaced sprintf() calls blindly with snprintf(). However, since snprintf() returns the would-be-printed size, not the actually output size, the length calculation can still go over the given limit. Use scnprintf() instead of snprintf(), which returns the actually output letters, for addressing the potential out-of-bounds access properly.

Published

2024-10-29T01:15:04.540

Last Modified

2024-11-08T16:15:45.653

Status

Modified

Source

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity

CVSSv3.1: 7.8 (HIGH)

Weaknesses
  • Type: Primary
    CWE-125
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System linux linux_kernel < 5.10.228 Yes
Operating System linux linux_kernel < 5.15.169 Yes
Operating System linux linux_kernel < 6.1.114 Yes
Operating System linux linux_kernel < 6.6.58 Yes
Operating System linux linux_kernel < 6.11.5 Yes
Operating System linux linux_kernel 6.12 Yes
Operating System linux linux_kernel 6.12 Yes
Operating System linux linux_kernel 6.12 Yes
Operating System redhat enterprise_linux 8.0 Yes
Operating System redhat enterprise_linux 9.0 Yes
References