CVE-2024-43845 (GCVE-0-2024-43845)
Vulnerability from cvelistv5
Published
2024-08-17 09:21
Modified
2025-06-19 12:39
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: udf: Fix bogus checksum computation in udf_rename() Syzbot reports uninitialized memory access in udf_rename() when updating checksum of '..' directory entry of a moved directory. This is indeed true as we pass on-stack diriter.fi to the udf_update_tag() and because that has only struct fileIdentDesc included in it and not the impUse or name fields, the checksumming function is going to checksum random stack contents beyond the end of the structure. This is actually harmless because the following udf_fiiter_write_fi() will recompute the checksum from on-disk buffers where everything is properly included. So all that is needed is just removing the bogus calculation.
References
Impacted products
Vendor Product Version
Linux Linux Version: 626860c470ff88e5f7f22a282efd1bfe953a1b54
Version: e9109a92d2a95889498bed3719cd2318892171a2
Version: e9109a92d2a95889498bed3719cd2318892171a2
Version: e9109a92d2a95889498bed3719cd2318892171a2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-43845",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:07:43.116457Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:22.040Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/udf/namei.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9c439311c13fc6faab1921441165c9b8b500c83b",
              "status": "affected",
              "version": "626860c470ff88e5f7f22a282efd1bfe953a1b54",
              "versionType": "git"
            },
            {
              "lessThan": "fe2ead240c31e8d158713beca9d0681a6e6a53ab",
              "status": "affected",
              "version": "e9109a92d2a95889498bed3719cd2318892171a2",
              "versionType": "git"
            },
            {
              "lessThan": "40d7b3ed52449d36143bab8d3e70926aa61a60f4",
              "status": "affected",
              "version": "e9109a92d2a95889498bed3719cd2318892171a2",
              "versionType": "git"
            },
            {
              "lessThan": "27ab33854873e6fb958cb074681a0107cc2ecc4c",
              "status": "affected",
              "version": "e9109a92d2a95889498bed3719cd2318892171a2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/udf/namei.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.44",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.3",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: Fix bogus checksum computation in udf_rename()\n\nSyzbot reports uninitialized memory access in udf_rename() when updating\nchecksum of \u0027..\u0027 directory entry of a moved directory. This is indeed\ntrue as we pass on-stack diriter.fi to the udf_update_tag() and because\nthat has only struct fileIdentDesc included in it and not the impUse or\nname fields, the checksumming function is going to checksum random stack\ncontents beyond the end of the structure. This is actually harmless\nbecause the following udf_fiiter_write_fi() will recompute the checksum\nfrom on-disk buffers where everything is properly included. So all that\nis needed is just removing the bogus calculation."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-19T12:39:21.257Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9c439311c13fc6faab1921441165c9b8b500c83b"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe2ead240c31e8d158713beca9d0681a6e6a53ab"
        },
        {
          "url": "https://git.kernel.org/stable/c/40d7b3ed52449d36143bab8d3e70926aa61a60f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/27ab33854873e6fb958cb074681a0107cc2ecc4c"
        }
      ],
      "title": "udf: Fix bogus checksum computation in udf_rename()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-43845",
    "datePublished": "2024-08-17T09:21:59.735Z",
    "dateReserved": "2024-08-17T09:11:59.275Z",
    "dateUpdated": "2025-06-19T12:39:21.257Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-43845\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:07:43.116457Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:23.012Z\"}}], \"cna\": {\"title\": \"udf: Fix bogus checksum computation in udf_rename()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"626860c470ff88e5f7f22a282efd1bfe953a1b54\", \"lessThan\": \"9c439311c13fc6faab1921441165c9b8b500c83b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e9109a92d2a95889498bed3719cd2318892171a2\", \"lessThan\": \"fe2ead240c31e8d158713beca9d0681a6e6a53ab\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e9109a92d2a95889498bed3719cd2318892171a2\", \"lessThan\": \"40d7b3ed52449d36143bab8d3e70926aa61a60f4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e9109a92d2a95889498bed3719cd2318892171a2\", \"lessThan\": \"27ab33854873e6fb958cb074681a0107cc2ecc4c\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/udf/namei.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.3\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.3\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.44\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/udf/namei.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/9c439311c13fc6faab1921441165c9b8b500c83b\"}, {\"url\": \"https://git.kernel.org/stable/c/fe2ead240c31e8d158713beca9d0681a6e6a53ab\"}, {\"url\": \"https://git.kernel.org/stable/c/40d7b3ed52449d36143bab8d3e70926aa61a60f4\"}, {\"url\": \"https://git.kernel.org/stable/c/27ab33854873e6fb958cb074681a0107cc2ecc4c\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nudf: Fix bogus checksum computation in udf_rename()\\n\\nSyzbot reports uninitialized memory access in udf_rename() when updating\\nchecksum of \u0027..\u0027 directory entry of a moved directory. This is indeed\\ntrue as we pass on-stack diriter.fi to the udf_update_tag() and because\\nthat has only struct fileIdentDesc included in it and not the impUse or\\nname fields, the checksumming function is going to checksum random stack\\ncontents beyond the end of the structure. This is actually harmless\\nbecause the following udf_fiiter_write_fi() will recompute the checksum\\nfrom on-disk buffers where everything is properly included. So all that\\nis needed is just removing the bogus calculation.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.44\", \"versionStartIncluding\": \"6.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.3\", \"versionStartIncluding\": \"6.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"6.3\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-06-19T12:39:21.257Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-43845\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-06-19T12:39:21.257Z\", \"dateReserved\": \"2024-08-17T09:11:59.275Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-17T09:21:59.735Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.