CVE-2024-42242

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci: Fix max_seg_size for 64KiB PAGE_SIZE blk_queue_max_segment_size() ensured: if (max_size < PAGE_SIZE) max_size = PAGE_SIZE; whereas: blk_validate_limits() makes it an error: if (WARN_ON_ONCE(lim->max_segment_size < PAGE_SIZE)) return -EINVAL; The change from one to the other, exposed sdhci which was setting maximum segment size too low in some circumstances. Fix the maximum segment size when it is too low.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/63d20a94f24fc1cbaf44d0e7c0e0a8077fde0aef	Patch
https://git.kernel.org/stable/c/bf78b1accef46efd9b624967cb74ae8d3c215a2b	Patch

Configurations

Configuration 1 (hide)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

History

08 Aug 2024, 14:53

Type	Values Removed	Values Added
First Time		Linux Linux linux Kernel
CPE		cpe:2.3:o:linux:linux_kernel::::::::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.5
References	~~() https://git.kernel.org/stable/c/63d20a94f24fc1cbaf44d0e7c0e0a8077fde0aef -~~	() https://git.kernel.org/stable/c/63d20a94f24fc1cbaf44d0e7c0e0a8077fde0aef - Patch
References	~~() https://git.kernel.org/stable/c/bf78b1accef46efd9b624967cb74ae8d3c215a2b -~~	() https://git.kernel.org/stable/c/bf78b1accef46efd9b624967cb74ae8d3c215a2b - Patch
Summary		(es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mmc: sdhci: Corrección max_seg_size para 64KiB PAGE_SIZE blk_queue_max_segment_size() asegurado: if (max_size < PAGE_SIZE) max_size = PAGE_SIZE; mientras que: blk_validate_limits() lo convierte en un error: if (WARN_ON_ONCE(lim->max_segment_size < PAGE_SIZE)) return -EINVAL; El cambio de uno a otro expuso a sdhci, que estaba estableciendo un tamaño de segmento máximo demasiado bajo en algunas circunstancias. Fije el tamaño máximo del segmento cuando sea demasiado bajo.
CWE		CWE-770

07 Aug 2024, 16:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-08-07 16:15

Updated : 2024-08-08 14:53

NVD link : CVE-2024-42242

Mitre link : CVE-2024-42242

CVE.ORG link : CVE-2024-42242

JSON object : View

Products Affected

linux

linux_kernel

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

5.5 /10