In the Linux kernel, the following vulnerability has been resolved: fs: Fix uninitialized value issue in from_kuid and from_kgid ocfs2_setattr() uses attr->ia_mode, attr->ia_uid and attr->ia_gid in a trace point even though ATTR_MODE, ATTR_UID and ATTR_GID aren't set. Initialize all fields of newattrs to avoid uninitialized variables, by checking if ATTR_MODE, ATTR_UID, ATTR_GID are initialized, otherwise 0.
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: fs: Se soluciona el problema de los valores no inicializados en from_kuid y from_kgid ocfs2_setattr() utiliza attr->ia_mode, attr->ia_uid y attr->ia_gid en un punto de seguimiento aunque ATTR_MODE, ATTR_UID y ATTR_GID no estén configurados. Inicializa todos los campos de newattrs para evitar variables no inicializadas, comprobando si ATTR_MODE, ATTR_UID, ATTR_GID están inicializados, de lo contrario, 0.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-908
|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary |
en
CWE-908
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd340226940> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd340224cc0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd385617440> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd2a2f6abc0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd3402244c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd340224ac0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd370265080> | Operating System |
| linux | linux_kernel | 6.12 | <built-in method update of dict object at 0x7fd384645f40> | Operating System |
| linux | linux_kernel | 6.12 | <built-in method update of dict object at 0x7fd384645d40> | Operating System |
| linux | linux_kernel | 6.12 | <built-in method update of dict object at 0x7fd340227640> | Operating System |
| linux | linux_kernel | 6.12 | <built-in method update of dict object at 0x7fd384dd03c0> | Operating System |
| linux | linux_kernel | 6.12 | <built-in method update of dict object at 0x7fd340227800> | Operating System |
| linux | linux_kernel | 6.12 | <built-in method update of dict object at 0x7fd384a1b8c0> | Operating System |
| linux | linux_kernel | 6.12 | <built-in method update of dict object at 0x7fd2dbff7e40> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.12:rc6:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.12:rc7:*:*:*:*:*:* |