CVE-2024-49996
Linux Kernel buffer overflow
- Published21 Oct 2024
Description
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix buffer overflow when parsing NFS reparse points ReparseDataLength is sum of the InodeType size and DataBuffer size. So to get DataBuffer size it is needed to subtract InodeType's size from ReparseDataLength. Function cifs_strndup_from_utf16() is currentlly accessing buf->DataBuffer at position after the end of the buffer because it does not subtract InodeType size from the length. Fix this problem and correctly subtract variable len. Member InodeType is present only when reparse buffer is large enough. Check for ReparseDataLength before accessing InodeType to prevent another invalid memory access. Major and minor rdev values are present also only when reparse buffer is large enough. Check for reparse buffer size before calling reparse_mkdev().
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:HAffected products
Remediation
- https://git.kernel.org/stable/c/01cdddde39b065074fd48f07027757783cbf5b7d
- https://git.kernel.org/stable/c/73b078e3314d4854fd8286f3ba65c860ddd3a3dd
- https://git.kernel.org/stable/c/7b222d6cb87077faf56a687a72af1951cf78c8a9
- https://git.kernel.org/stable/c/803b3a39cb096d8718c0aebc03fd19f11c7dc919
- https://git.kernel.org/stable/c/c173d47b69f07cd7ca08efb4e458adbd4725d8e9
- https://git.kernel.org/stable/c/c6db81c550cea0c73bd72ef55f579991e0e4ba07
References
- https://git.kernel.org/stable/c/01cdddde39b065074fd48f07027757783cbf5b7d
- https://git.kernel.org/stable/c/73b078e3314d4854fd8286f3ba65c860ddd3a3dd
- https://git.kernel.org/stable/c/7b222d6cb87077faf56a687a72af1951cf78c8a9
- https://git.kernel.org/stable/c/803b3a39cb096d8718c0aebc03fd19f11c7dc919
- https://git.kernel.org/stable/c/c173d47b69f07cd7ca08efb4e458adbd4725d8e9
- https://git.kernel.org/stable/c/c6db81c550cea0c73bd72ef55f579991e0e4ba07
- https://git.kernel.org/stable/c/e2a8910af01653c1c268984855629d71fb81f404
- https://git.kernel.org/stable/c/ec79e6170bcae8a6036a4b6960f5e7e59a785601
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html
Related CVEs
Recent high-severity vulnerabilities sharing a weakness type.
Frequently asked
Is CVE-2024-49996 being actively exploited?
CVE-2024-49996 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.79%.
How severe is CVE-2024-49996?
CVE-2024-49996 has a CVSS 3.1 base score of 9.4, rated critical. EPSS estimates a 0.79% probability of exploitation.
Which products are affected by CVE-2024-49996?
Affected products include Debian Linux, Linux Kernel.
How do I fix CVE-2024-49996?
Upgrade affected software to a fixed version, for example Linux Kernel 5.15.174 or later, then confirm no affected versions remain in your inventory.
How Secuno handles this
Secuno correlates vulnerabilities like CVE-2024-49996 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.
Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.