{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-47682", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-09-30T16:00:12.941Z", "datePublished": "2024-10-21T11:53:24.460Z", "dateUpdated": "2024-12-19T09:25:54.170Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-12-19T09:25:54.170Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: sd: Fix off-by-one error in sd_read_block_characteristics()\n\nFf the device returns page 0xb1 with length 8 (happens with qemu v2.x, for\nexample), sd_read_block_characteristics() may attempt an out-of-bounds\nmemory access when accessing the zoned field at offset 8."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/scsi/sd.c"], "versions": [{"version": "7fb019c46eeea4e3cc3ddfd3e01a24e610f34fac", "lessThan": "60312ae7392f9c75c6591a52fc359cf7f810d48f", "status": "affected", "versionType": "git"}, {"version": "7fb019c46eeea4e3cc3ddfd3e01a24e610f34fac", "lessThan": "568c7c4c77eee6df7677bb861b7cee7398a3255d", "status": "affected", "versionType": "git"}, {"version": "7fb019c46eeea4e3cc3ddfd3e01a24e610f34fac", "lessThan": "a776050373893e4c847a49abeae2ccb581153df0", "status": "affected", "versionType": "git"}, {"version": "7fb019c46eeea4e3cc3ddfd3e01a24e610f34fac", "lessThan": "413df704f149dec585df07466d2401bbd1f490a0", "status": "affected", "versionType": "git"}, {"version": "7fb019c46eeea4e3cc3ddfd3e01a24e610f34fac", "lessThan": "f81eaf08385ddd474a2f41595a7757502870c0eb", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/scsi/sd.c"], "versions": [{"version": "5.19", "status": "affected"}, {"version": "0", "lessThan": "5.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.113", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.54", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10.13", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.11.2", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/60312ae7392f9c75c6591a52fc359cf7f810d48f"}, {"url": "https://git.kernel.org/stable/c/568c7c4c77eee6df7677bb861b7cee7398a3255d"}, {"url": "https://git.kernel.org/stable/c/a776050373893e4c847a49abeae2ccb581153df0"}, {"url": "https://git.kernel.org/stable/c/413df704f149dec585df07466d2401bbd1f490a0"}, {"url": "https://git.kernel.org/stable/c/f81eaf08385ddd474a2f41595a7757502870c0eb"}], "title": "scsi: sd: Fix off-by-one error in sd_read_block_characteristics()", "x_generator": {"engine": "bippy-5f407fcff5a0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-47682", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-21T13:07:09.255382Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-21T13:14:16.478Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-47682", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-21T13:07:09.255382Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-21T13:07:12.473Z"}}], "cna": {"title": "scsi: sd: Fix off-by-one error in sd_read_block_characteristics()", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "7fb019c46eeea4e3cc3ddfd3e01a24e610f34fac", "lessThan": "60312ae7392f9c75c6591a52fc359cf7f810d48f", "versionType": "git"}, {"status": "affected", "version": "7fb019c46eeea4e3cc3ddfd3e01a24e610f34fac", "lessThan": "568c7c4c77eee6df7677bb861b7cee7398a3255d", "versionType": "git"}, {"status": "affected", "version": "7fb019c46eeea4e3cc3ddfd3e01a24e610f34fac", "lessThan": "a776050373893e4c847a49abeae2ccb581153df0", "versionType": "git"}, {"status": "affected", "version": "7fb019c46eeea4e3cc3ddfd3e01a24e610f34fac", "lessThan": "413df704f149dec585df07466d2401bbd1f490a0", "versionType": "git"}, {"status": "affected", "version": "7fb019c46eeea4e3cc3ddfd3e01a24e610f34fac", "lessThan": "f81eaf08385ddd474a2f41595a7757502870c0eb", "versionType": "git"}], "programFiles": ["drivers/scsi/sd.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.19"}, {"status": "unaffected", "version": "0", "lessThan": "5.19", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.113", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.54", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.10.13", "versionType": "semver", "lessThanOrEqual": "6.10.*"}, {"status": "unaffected", "version": "6.11.2", "versionType": "semver", "lessThanOrEqual": "6.11.*"}, {"status": "unaffected", "version": "6.12", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/scsi/sd.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/60312ae7392f9c75c6591a52fc359cf7f810d48f"}, {"url": "https://git.kernel.org/stable/c/568c7c4c77eee6df7677bb861b7cee7398a3255d"}, {"url": "https://git.kernel.org/stable/c/a776050373893e4c847a49abeae2ccb581153df0"}, {"url": "https://git.kernel.org/stable/c/413df704f149dec585df07466d2401bbd1f490a0"}, {"url": "https://git.kernel.org/stable/c/f81eaf08385ddd474a2f41595a7757502870c0eb"}], "x_generator": {"engine": "bippy-5f407fcff5a0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: sd: Fix off-by-one error in sd_read_block_characteristics()\n\nFf the device returns page 0xb1 with length 8 (happens with qemu v2.x, for\nexample), sd_read_block_characteristics() may attempt an out-of-bounds\nmemory access when accessing the zoned field at offset 8."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-12-19T09:25:54.170Z"}}}, "cveMetadata": {"cveId": "CVE-2024-47682", "state": "PUBLISHED", "dateUpdated": "2024-12-19T09:25:54.170Z", "dateReserved": "2024-09-30T16:00:12.941Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-10-21T11:53:24.460Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7D848431-3C7A-4C40-BC35-515047E89ABE", "versionEndExcluding": "6.1.113", "versionStartIncluding": "5.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D448821D-C085-4CAF-88FA-2DDE7BE21976", "versionEndExcluding": "6.6.54", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "CE94BB8D-B0AB-4563-9ED7-A12122B56EBE", "versionEndExcluding": "6.10.13", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "AB755D26-97F4-43B6-8604-CD076811E181", "versionEndExcluding": "6.11.2", "versionStartIncluding": "6.11", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: sd: Fix off-by-one error in sd_read_block_characteristics()\n\nFf the device returns page 0xb1 with length 8 (happens with qemu v2.x, for\nexample), sd_read_block_characteristics() may attempt an out-of-bounds\nmemory access when accessing the zoned field at offset 8."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: scsi: sd: Se corrige el error de un byte en sd_read_block_characteristics() Si el dispositivo devuelve la p\u00e1gina 0xb1 con una longitud de 8 (sucede con qemu v2.x, por ejemplo), sd_read_block_characteristics() puede intentar un acceso a la memoria fuera de los l\u00edmites al acceder al campo zonificado en el desplazamiento 8."}], "id": "CVE-2024-47682", "lastModified": "2024-10-23T14:57:12.700", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "[email protected]", "type": "Primary"}]}, "published": "2024-10-21T12:15:05.143", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/413df704f149dec585df07466d2401bbd1f490a0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/568c7c4c77eee6df7677bb861b7cee7398a3255d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/60312ae7392f9c75c6591a52fc359cf7f810d48f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a776050373893e4c847a49abeae2ccb581153df0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f81eaf08385ddd474a2f41595a7757502870c0eb"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-193"}], "source": "[email protected]", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: scsi: sd: Fix off-by-one error in sd_read_block_characteristics()", "id": "2320177", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2320177"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-193", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nscsi: sd: Fix off-by-one error in sd_read_block_characteristics()\nFf the device returns page 0xb1 with length 8 (happens with qemu v2.x, for\nexample), sd_read_block_characteristics() may attempt an out-of-bounds\nmemory access when accessing the zoned field at offset 8."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-47682", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-10-21T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-47682\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-47682\nhttps://lore.kernel.org/linux-cve-announce/2024102108-CVE-2024-47682-0582@gregkh/T"], "statement": "The issue could happen only during system boot or disc installation (being called when disc seen first time). Out of boundary read of one value unlikely can lead to kernel crash. As result the security impact is limited.", "threat_severity": "Moderate"}