CVE-2024-47742 (GCVE-0-2024-47742)
Vulnerability from cvelistv5
Published
2024-10-21 12:14
Modified
2026-08-05 11:39
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: firmware_loader: Block path traversal Most firmware names are hardcoded strings, or are constructed from fairly constrained format strings where the dynamic parts are just some hex numbers or such. However, there are a couple codepaths in the kernel where firmware file names contain string components that are passed through from a device or semi-privileged userspace; the ones I could find (not counting interfaces that require root privileges) are: - lpfc_sli4_request_firmware_update() seems to construct the firmware filename from "ModelName", a string that was previously parsed out of some descriptor ("Vital Product Data") in lpfc_fill_vpd() - nfp_net_fw_find() seems to construct a firmware filename from a model name coming from nfp_hwinfo_lookup(pf->hwinfo, "nffw.partno"), which I think parses some descriptor that was read from the device. (But this case likely isn't exploitable because the format string looks like "netronome/nic_%s", and there shouldn't be any *folders* starting with "netronome/nic_". The previous case was different because there, the "%s" is *at the start* of the format string.) - module_flash_fw_schedule() is reachable from the ETHTOOL_MSG_MODULE_FW_FLASH_ACT netlink command, which is marked as GENL_UNS_ADMIN_PERM (meaning CAP_NET_ADMIN inside a user namespace is enough to pass the privilege check), and takes a userspace-provided firmware name. (But I think to reach this case, you need to have CAP_NET_ADMIN over a network namespace that a special kind of ethernet device is mapped into, so I think this is not a viable attack path in practice.) Fix it by rejecting any firmware names containing ".." path components. For what it's worth, I went looking and haven't found any USB device drivers that use the firmware loader dangerously.
References
Impacted products
Vendor Product Version
Linux Linux Version: abb139e75c2cdbb955e840d6331cb5863e409d0e
Version: abb139e75c2cdbb955e840d6331cb5863e409d0e
Version: abb139e75c2cdbb955e840d6331cb5863e409d0e
Version: abb139e75c2cdbb955e840d6331cb5863e409d0e
Version: abb139e75c2cdbb955e840d6331cb5863e409d0e
Version: abb139e75c2cdbb955e840d6331cb5863e409d0e
Version: abb139e75c2cdbb955e840d6331cb5863e409d0e
Version: abb139e75c2cdbb955e840d6331cb5863e409d0e
Version: abb139e75c2cdbb955e840d6331cb5863e409d0e
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47742",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-21T12:59:04.060717Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-21T13:04:14.368Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:21:38.407Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/base/firmware_loader/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d1768e5535d3ded59f888637016e6f821f4e069f",
              "status": "affected",
              "version": "abb139e75c2cdbb955e840d6331cb5863e409d0e",
              "versionType": "git"
            },
            {
              "lessThan": "9b1ca33ebd05b3acef5b976c04e5e791af93ce1b",
              "status": "affected",
              "version": "abb139e75c2cdbb955e840d6331cb5863e409d0e",
              "versionType": "git"
            },
            {
              "lessThan": "c30558e6c5c9ad6c86459d9acce1520ceeab9ea6",
              "status": "affected",
              "version": "abb139e75c2cdbb955e840d6331cb5863e409d0e",
              "versionType": "git"
            },
            {
              "lessThan": "a77fc4acfd49fc6076e565445b2bc5fdc3244da4",
              "status": "affected",
              "version": "abb139e75c2cdbb955e840d6331cb5863e409d0e",
              "versionType": "git"
            },
            {
              "lessThan": "3d2411f4edcb649eaf232160db459bb4770b5251",
              "status": "affected",
              "version": "abb139e75c2cdbb955e840d6331cb5863e409d0e",
              "versionType": "git"
            },
            {
              "lessThan": "7420c1bf7fc784e587b87329cc6dfa3dca537aa4",
              "status": "affected",
              "version": "abb139e75c2cdbb955e840d6331cb5863e409d0e",
              "versionType": "git"
            },
            {
              "lessThan": "28f1cd94d3f1092728fb775a0fe26c5f1ac2ebeb",
              "status": "affected",
              "version": "abb139e75c2cdbb955e840d6331cb5863e409d0e",
              "versionType": "git"
            },
            {
              "lessThan": "6c4e13fdfcab34811c3143a0a03c05fec4e870ec",
              "status": "affected",
              "version": "abb139e75c2cdbb955e840d6331cb5863e409d0e",
              "versionType": "git"
            },
            {
              "lessThan": "f0e5311aa8022107d63c54e2f03684ec097d1394",
              "status": "affected",
              "version": "abb139e75c2cdbb955e840d6331cb5863e409d0e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/base/firmware_loader/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.7"
            },
            {
              "lessThan": "3.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.323",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.285",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.227",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.323",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.285",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.227",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.168",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.113",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.54",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.13",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.2",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware_loader: Block path traversal\n\nMost firmware names are hardcoded strings, or are constructed from fairly\nconstrained format strings where the dynamic parts are just some hex\nnumbers or such.\n\nHowever, there are a couple codepaths in the kernel where firmware file\nnames contain string components that are passed through from a device or\nsemi-privileged userspace; the ones I could find (not counting interfaces\nthat require root privileges) are:\n\n - lpfc_sli4_request_firmware_update() seems to construct the firmware\n   filename from \"ModelName\", a string that was previously parsed out of\n   some descriptor (\"Vital Product Data\") in lpfc_fill_vpd()\n - nfp_net_fw_find() seems to construct a firmware filename from a model\n   name coming from nfp_hwinfo_lookup(pf-\u003ehwinfo, \"nffw.partno\"), which I\n   think parses some descriptor that was read from the device.\n   (But this case likely isn\u0027t exploitable because the format string looks\n   like \"netronome/nic_%s\", and there shouldn\u0027t be any *folders* starting\n   with \"netronome/nic_\". The previous case was different because there,\n   the \"%s\" is *at the start* of the format string.)\n - module_flash_fw_schedule() is reachable from the\n   ETHTOOL_MSG_MODULE_FW_FLASH_ACT netlink command, which is marked as\n   GENL_UNS_ADMIN_PERM (meaning CAP_NET_ADMIN inside a user namespace is\n   enough to pass the privilege check), and takes a userspace-provided\n   firmware name.\n   (But I think to reach this case, you need to have CAP_NET_ADMIN over a\n   network namespace that a special kind of ethernet device is mapped into,\n   so I think this is not a viable attack path in practice.)\n\nFix it by rejecting any firmware names containing \"..\" path components.\n\nFor what it\u0027s worth, I went looking and haven\u0027t found any USB device\ndrivers that use the firmware loader dangerously."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The most viable attacker-triggerable path is the local ETHTOOL_MSG_MODULE_FW_FLASH_ACT generic-netlink command, which passes a fully attacker-controlled filename string into request_firmware_direct(); the device-side paths (lpfc VPD, nfp hwinfo) would only be Physical, so Local is the higher-severity reachable vector.\nAC:L - There is no race, no memory-layout dependency, and no probabilistic element \u2014 the attacker supplies the \"..\" path directly and traversal succeeds deterministically on the first attempt.\nPR:L - The ethtool op is marked GENL_UNS_ADMIN_PERM, meaning CAP_NET_ADMIN inside a user namespace satisfies the check, which per kernel scoring practice is an unprivileged local user; the alternative lpfc path needs no host credentials at all, only a device supplying a malicious VPD ModelName string.\nUI:N - The attacker sends the netlink request itself and the firmware load happens synchronously in that syscall; no victim action is required (and on the lpfc path the load fires automatically from the driver\u0027s probe/init routine).\nS:U - The vulnerable component and the impacted resources are both the host kernel and its filesystem \u2014 there is no VM, hypervisor, or IOMMU boundary crossed, so this is standard in-kernel impact.\nC:H - _request_firmware() reads the target with kernel credentials (override_creds(prepare_kernel_cred(\u0026init_task))) resolved against init\u0027s mount namespace, so traversal yields an arbitrary root-privileged read of any file on the host (/etc/shadow, TLS/SSH private keys), and the contents are then shipped into device flash where an attacker controlling the HBA or transceiver can retrieve them.\nI:H - The traversal breaks the firmware loader\u0027s guarantee that images come only from root-owned /lib/firmware, letting the attacker redirect the load to a file they wrote themselves and have that unvalidated content flashed into device firmware (lpfc_wr_object / CMIS module update) as well as parsed by driver firmware-parsing code that trusts its input.\nA:H - Writing non-firmware or attacker-authored content into an HBA\u0027s or optical module\u0027s flash can permanently brick the adapter, driver firmware parsers readily oops on arbitrary non-firmware data, and kernel_read_file() vmalloc()s the entire target file (up to INT_MAX) so pointing at a multi-gigabyte file drives the machine into memory exhaustion."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:39:52.866Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d1768e5535d3ded59f888637016e6f821f4e069f"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b1ca33ebd05b3acef5b976c04e5e791af93ce1b"
        },
        {
          "url": "https://git.kernel.org/stable/c/c30558e6c5c9ad6c86459d9acce1520ceeab9ea6"
        },
        {
          "url": "https://git.kernel.org/stable/c/a77fc4acfd49fc6076e565445b2bc5fdc3244da4"
        },
        {
          "url": "https://git.kernel.org/stable/c/3d2411f4edcb649eaf232160db459bb4770b5251"
        },
        {
          "url": "https://git.kernel.org/stable/c/7420c1bf7fc784e587b87329cc6dfa3dca537aa4"
        },
        {
          "url": "https://git.kernel.org/stable/c/28f1cd94d3f1092728fb775a0fe26c5f1ac2ebeb"
        },
        {
          "url": "https://git.kernel.org/stable/c/6c4e13fdfcab34811c3143a0a03c05fec4e870ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0e5311aa8022107d63c54e2f03684ec097d1394"
        }
      ],
      "title": "firmware_loader: Block path traversal",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-47742",
    "datePublished": "2024-10-21T12:14:10.499Z",
    "dateReserved": "2024-09-30T16:00:12.959Z",
    "dateUpdated": "2026-08-05T11:39:52.866Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:21:38.407Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-47742\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-21T12:59:04.060717Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-21T12:59:07.169Z\"}}], \"cna\": {\"title\": \"firmware_loader: Block path traversal\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"abb139e75c2cdbb955e840d6331cb5863e409d0e\", \"lessThan\": \"d1768e5535d3ded59f888637016e6f821f4e069f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"abb139e75c2cdbb955e840d6331cb5863e409d0e\", \"lessThan\": \"9b1ca33ebd05b3acef5b976c04e5e791af93ce1b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"abb139e75c2cdbb955e840d6331cb5863e409d0e\", \"lessThan\": \"c30558e6c5c9ad6c86459d9acce1520ceeab9ea6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"abb139e75c2cdbb955e840d6331cb5863e409d0e\", \"lessThan\": \"a77fc4acfd49fc6076e565445b2bc5fdc3244da4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"abb139e75c2cdbb955e840d6331cb5863e409d0e\", \"lessThan\": \"3d2411f4edcb649eaf232160db459bb4770b5251\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"abb139e75c2cdbb955e840d6331cb5863e409d0e\", \"lessThan\": \"7420c1bf7fc784e587b87329cc6dfa3dca537aa4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"abb139e75c2cdbb955e840d6331cb5863e409d0e\", \"lessThan\": \"28f1cd94d3f1092728fb775a0fe26c5f1ac2ebeb\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"abb139e75c2cdbb955e840d6331cb5863e409d0e\", \"lessThan\": \"6c4e13fdfcab34811c3143a0a03c05fec4e870ec\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"abb139e75c2cdbb955e840d6331cb5863e409d0e\", \"lessThan\": \"f0e5311aa8022107d63c54e2f03684ec097d1394\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/base/firmware_loader/main.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.323\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.285\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.227\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.168\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.113\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.54\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/base/firmware_loader/main.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d1768e5535d3ded59f888637016e6f821f4e069f\"}, {\"url\": \"https://git.kernel.org/stable/c/9b1ca33ebd05b3acef5b976c04e5e791af93ce1b\"}, {\"url\": \"https://git.kernel.org/stable/c/c30558e6c5c9ad6c86459d9acce1520ceeab9ea6\"}, {\"url\": \"https://git.kernel.org/stable/c/a77fc4acfd49fc6076e565445b2bc5fdc3244da4\"}, {\"url\": \"https://git.kernel.org/stable/c/3d2411f4edcb649eaf232160db459bb4770b5251\"}, {\"url\": \"https://git.kernel.org/stable/c/7420c1bf7fc784e587b87329cc6dfa3dca537aa4\"}, {\"url\": \"https://git.kernel.org/stable/c/28f1cd94d3f1092728fb775a0fe26c5f1ac2ebeb\"}, {\"url\": \"https://git.kernel.org/stable/c/6c4e13fdfcab34811c3143a0a03c05fec4e870ec\"}, {\"url\": \"https://git.kernel.org/stable/c/f0e5311aa8022107d63c54e2f03684ec097d1394\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfirmware_loader: Block path traversal\\n\\nMost firmware names are hardcoded strings, or are constructed from fairly\\nconstrained format strings where the dynamic parts are just some hex\\nnumbers or such.\\n\\nHowever, there are a couple codepaths in the kernel where firmware file\\nnames contain string components that are passed through from a device or\\nsemi-privileged userspace; the ones I could find (not counting interfaces\\nthat require root privileges) are:\\n\\n - lpfc_sli4_request_firmware_update() seems to construct the firmware\\n   filename from \\\"ModelName\\\", a string that was previously parsed out of\\n   some descriptor (\\\"Vital Product Data\\\") in lpfc_fill_vpd()\\n - nfp_net_fw_find() seems to construct a firmware filename from a model\\n   name coming from nfp_hwinfo_lookup(pf-\u003ehwinfo, \\\"nffw.partno\\\"), which I\\n   think parses some descriptor that was read from the device.\\n   (But this case likely isn\u0027t exploitable because the format string looks\\n   like \\\"netronome/nic_%s\\\", and there shouldn\u0027t be any *folders* starting\\n   with \\\"netronome/nic_\\\". The previous case was different because there,\\n   the \\\"%s\\\" is *at the start* of the format string.)\\n - module_flash_fw_schedule() is reachable from the\\n   ETHTOOL_MSG_MODULE_FW_FLASH_ACT netlink command, which is marked as\\n   GENL_UNS_ADMIN_PERM (meaning CAP_NET_ADMIN inside a user namespace is\\n   enough to pass the privilege check), and takes a userspace-provided\\n   firmware name.\\n   (But I think to reach this case, you need to have CAP_NET_ADMIN over a\\n   network namespace that a special kind of ethernet device is mapped into,\\n   so I think this is not a viable attack path in practice.)\\n\\nFix it by rejecting any firmware names containing \\\"..\\\" path components.\\n\\nFor what it\u0027s worth, I went looking and haven\u0027t found any USB device\\ndrivers that use the firmware loader dangerously.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.323\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.285\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.227\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.168\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.113\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.54\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.13\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.2\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"3.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:39:52.617Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-47742\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:39:52.617Z\", \"dateReserved\": \"2024-09-30T16:00:12.959Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T12:14:10.499Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.