A flaw was found in the exFAT driver of the Linux kernel. The vulnerability exists in the implementation of the file name reconstruction function, which is responsible for reading file name entries from a directory index and merging file name parts belonging to one file into a single long file name. Since the file name characters are copied into a stack variable, a local privileged attacker could use this flaw to overflow the kernel stack.
Se ha encontrado un fallo en el controlador exFAT del núcleo de Linux. La vulnerabilidad se encuentra en la implementación de la función de reconstrucción de nombres de archivo, que se encarga de leer entradas de nombres de archivo de un índice de directorio y fusionar partes de nombres de archivo pertenecientes a un archivo en un único nombre de archivo largo. Dado que los caracteres del nombre de archivo se copian en una variable de pila, un atacante local con privilegios podría utilizar este fallo para desbordar la pila del kernel.
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | HIGH |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-121
|
| [email protected] | Primary |
en
CWE-787
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd34126a040> | Operating System |
| linux | linux_kernel | 6.5 | <built-in method update of dict object at 0x7fd34088cc40> | Operating System |
| linux | linux_kernel | 6.5 | <built-in method update of dict object at 0x7fd36b89eb40> | Operating System |
| linux | linux_kernel | 6.5 | <built-in method update of dict object at 0x7fd341efae00> | Operating System |
| linux | linux_kernel | 6.5 | <built-in method update of dict object at 0x7fd34126abc0> | Operating System |
| fedoraproject | fedora | 37 | <built-in method update of dict object at 0x7fd341268800> | Operating System |
| fedoraproject | fedora | 38 | <built-in method update of dict object at 0x7fd34088df80> | Operating System |
| redhat | enterprise_linux | 9.0 | <built-in method update of dict object at 0x7fd340b011c0> | Operating System |
| debian | debian_linux | 11.0 | <built-in method update of dict object at 0x7fd34088de80> | Operating System |
| debian | debian_linux | 12.0 | <built-in method update of dict object at 0x7fd341269e80> | Operating System |
| netapp | h300s_firmware | - | <built-in method update of dict object at 0x7fd39c4e4300> | Operating System |
| netapp | h500s_firmware | - | <built-in method update of dict object at 0x7fd34088c680> | Operating System |
| netapp | h700s_firmware | - | <built-in method update of dict object at 0x7fd36b89e140> | Operating System |
| netapp | h410s_firmware | - | <built-in method update of dict object at 0x7fd39c408180> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.5:rc1:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.5:rc2:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.5:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.5:rc4:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* |