CVE-2024-39480

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-39480", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-06-25T14:23:23.746Z", "datePublished": "2024-07-05T06:55:09.241Z", "dateUpdated": "2026-08-05T11:33:34.087Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:33:34.087Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkdb: Fix buffer overflow during tab-complete\n\nCurrently, when the user attempts symbol completion with the Tab key, kdb\nwill use strncpy() to insert the completed symbol into the command buffer.\nUnfortunately it passes the size of the source buffer rather than the\ndestination to strncpy() with predictably horrible results. Most obviously\nif the command buffer is already full but cp, the cursor position, is in\nthe middle of the buffer, then we will write past the end of the supplied\nbuffer.\n\nFix this by replacing the dubious strncpy() calls with memmove()/memcpy()\ncalls plus explicit boundary checks to make sure we have enough space\nbefore we start moving characters around."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - kdb_read() is reachable only from the in-kernel debugger prompt, entered via Magic SysRq-'g' from the physical keyboard or a BREAK on the serial console (or root via /proc/sysrq-trigger); it is not bound to the network stack. CVSS 3.1 classifies exploitation \"by accessing the target system locally (e.g., keyboard, console)\" as Local rather than Physical.\nAC:L - The attacker fully controls the input line \u2014 filling the command buffer near its 198-byte limit, repositioning the cursor mid-line, and pressing Tab deterministically drives the unbounded strncpy() past the end of cmd_cur[200] and tmpbuffer[256]. There is no race, no timing window, and no memory-layout condition outside the attacker's control.\nPR:N - The SysRq-'g' console/serial entry path requires no account, login, or credentials on the target \u2014 sysrq_dbg_op has enable_mask 0 and passes on the default sysrq_enabled==1 \u2014 and a panic/oops leaves the kdb prompt open to anyone at the console. On an embedded, automotive, or appliance board with kgdboc on an exposed serial header, an unauthenticated attacker reaches the prompt directly.\nUI:N - The attacker types the over-long line and presses Tab themselves at the debugger prompt. No action by any other user or victim is needed.\nS:U - The out-of-bounds write corrupts kernel .bss within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The overflow destroys adjacent .bss contents including NUL terminators, so the subsequent kdb_printf(\"%s\", cp) walks past the buffer and dumps adjacent kernel memory to the console, and the OOB write into unguarded static memory can be further leveraged for arbitrary disclosure.\nI:H - This is an out-of-bounds write of attacker-influenced content (typed characters plus kernel symbol names) with an attacker-chosen length into static .bss buffers (cmd_cur[200], tmpbuffer[256]) that have no canary or guard page, corrupting neighbouring kernel globals and enabling control-flow-relevant corruption.\nA:H - Writing past the end of these static buffers corrupts adjacent kernel state and reliably produces oops/panic or a wedged debugger, taking the system down."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/debug/kdb/kdb_io.c"], "versions": [{"version": "5d5314d6795f3c1c0f415348ff8c51f7de042b77", "lessThan": "fb824a99e148ff272a53d71d84122728b5f00992", "status": "affected", "versionType": "git"}, {"version": "5d5314d6795f3c1c0f415348ff8c51f7de042b77", "lessThan": "ddd2972d8e2dee3b33e8121669d55def59f0be8a", "status": "affected", "versionType": "git"}, {"version": "5d5314d6795f3c1c0f415348ff8c51f7de042b77", "lessThan": "cfdc2fa4db57503bc6d3817240547c8ddc55fa96", "status": "affected", "versionType": "git"}, {"version": "5d5314d6795f3c1c0f415348ff8c51f7de042b77", "lessThan": "f636a40834d22e5e3fc748f060211879c056cd33", "status": "affected", "versionType": "git"}, {"version": "5d5314d6795f3c1c0f415348ff8c51f7de042b77", "lessThan": "33d9c814652b971461d1e30bead6792851c209e7", "status": "affected", "versionType": "git"}, {"version": "5d5314d6795f3c1c0f415348ff8c51f7de042b77", "lessThan": "107e825cc448b7834b31e8b1b3cf0f57426d46d5", "status": "affected", "versionType": "git"}, {"version": "5d5314d6795f3c1c0f415348ff8c51f7de042b77", "lessThan": "f694da720dcf795dc3eb97bf76d220213f76aaa7", "status": "affected", "versionType": "git"}, {"version": "5d5314d6795f3c1c0f415348ff8c51f7de042b77", "lessThan": "e9730744bf3af04cda23799029342aa3cddbc454", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/debug/kdb/kdb_io.c"], "versions": [{"version": "2.6.35", "status": "affected"}, {"version": "0", "lessThan": "2.6.35", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.316", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.278", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.219", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.161", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.94", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.34", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9.5", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "4.19.316"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "5.4.278"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "5.10.219"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "5.15.161"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "6.1.94"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "6.6.34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "6.9.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "6.10"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/fb824a99e148ff272a53d71d84122728b5f00992"}, {"url": "https://git.kernel.org/stable/c/ddd2972d8e2dee3b33e8121669d55def59f0be8a"}, {"url": "https://git.kernel.org/stable/c/cfdc2fa4db57503bc6d3817240547c8ddc55fa96"}, {"url": "https://git.kernel.org/stable/c/f636a40834d22e5e3fc748f060211879c056cd33"}, {"url": "https://git.kernel.org/stable/c/33d9c814652b971461d1e30bead6792851c209e7"}, {"url": "https://git.kernel.org/stable/c/107e825cc448b7834b31e8b1b3cf0f57426d46d5"}, {"url": "https://git.kernel.org/stable/c/f694da720dcf795dc3eb97bf76d220213f76aaa7"}, {"url": "https://git.kernel.org/stable/c/e9730744bf3af04cda23799029342aa3cddbc454"}], "title": "kdb: Fix buffer overflow during tab-complete", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:26:15.655Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/fb824a99e148ff272a53d71d84122728b5f00992", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ddd2972d8e2dee3b33e8121669d55def59f0be8a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/cfdc2fa4db57503bc6d3817240547c8ddc55fa96", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/f636a40834d22e5e3fc748f060211879c056cd33", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/33d9c814652b971461d1e30bead6792851c209e7", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/107e825cc448b7834b31e8b1b3cf0f57426d46d5", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/f694da720dcf795dc3eb97bf76d220213f76aaa7", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e9730744bf3af04cda23799029342aa3cddbc454", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-121", "lang": "en", "description": "CWE-121 Stack-based Buffer Overflow"}]}], "affected": [{"vendor": "linux", "product": "linux_kernel", "cpes": ["cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "1da177e4c3f4", "status": "affected", "lessThan": "fb824a99e148", "versionType": "git"}, {"version": "1da177e4c3f4", "status": "affected", "lessThan": "ddd2972d8e2d", "versionType": "git"}, {"version": "1da177e4c3f4", "status": "affected", "lessThan": "cfdc2fa4db57", "versionType": "git"}, {"version": "1da177e4c3f4", "status": "affected", "lessThan": "f636a40834d2", "versionType": "git"}, {"version": "1da177e4c3f4", "status": "affected", "lessThan": "33d9c814652b", "versionType": "git"}, {"version": "1da177e4c3f4", "status": "affected", "lessThan": "107e825cc448", "versionType": "git"}, {"version": "1da177e4c3f4", "status": "affected", "lessThan": "f694da720dcf", "versionType": "git"}, {"version": "1da177e4c3f4", "status": "affected", "lessThan": "e9730744bf3a", "versionType": "git"}, {"version": "4.19.316", "status": "unaffected", "lessThanOrEqual": "4.20", "versionType": "git"}, {"version": "5.4.278", "status": "unaffected", "lessThanOrEqual": "5.5", "versionType": "git"}, {"version": "5.10.219", "status": "unaffected", "lessThanOrEqual": "5.11", "versionType": "git"}, {"version": "5.15.161", "status": "unaffected", "lessThanOrEqual": "5.16", "versionType": "git"}, {"version": "6.1.94", "status": "unaffected", "lessThanOrEqual": "6.2", "versionType": "git"}, {"version": "6.6.34", "status": "unaffected", "lessThanOrEqual": "6.7", "versionType": "git"}, {"version": "6.9.5", "status": "unaffected", "lessThanOrEqual": "6.10", "versionType": "git"}, {"version": "6.10", "status": "unaffected", "lessThanOrEqual": "*", "versionType": "git"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-08-20T03:55:14.759316Z", "id": "CVE-2024-39480", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-27T14:14:17.550Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/fb824a99e148ff272a53d71d84122728b5f00992", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ddd2972d8e2dee3b33e8121669d55def59f0be8a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/cfdc2fa4db57503bc6d3817240547c8ddc55fa96", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/f636a40834d22e5e3fc748f060211879c056cd33", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/33d9c814652b971461d1e30bead6792851c209e7", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/107e825cc448b7834b31e8b1b3cf0f57426d46d5", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/f694da720dcf795dc3eb97bf76d220213f76aaa7", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e9730744bf3af04cda23799029342aa3cddbc454", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:26:15.655Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-39480", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-08-20T03:55:14.759316Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "affected", "version": "1da177e4c3f4", "lessThan": "fb824a99e148", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "ddd2972d8e2d", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "cfdc2fa4db57", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "f636a40834d2", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "33d9c814652b", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "107e825cc448", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "f694da720dcf", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "e9730744bf3a", "versionType": "git"}, {"status": "unaffected", "version": "4.19.316", "versionType": "git", "lessThanOrEqual": "4.20"}, {"status": "unaffected", "version": "5.4.278", "versionType": "git", "lessThanOrEqual": "5.5"}, {"status": "unaffected", "version": "5.10.219", "versionType": "git", "lessThanOrEqual": "5.11"}, {"status": "unaffected", "version": "5.15.161", "versionType": "git", "lessThanOrEqual": "5.16"}, {"status": "unaffected", "version": "6.1.94", "versionType": "git", "lessThanOrEqual": "6.2"}, {"status": "unaffected", "version": "6.6.34", "versionType": "git", "lessThanOrEqual": "6.7"}, {"status": "unaffected", "version": "6.9.5", "versionType": "git", "lessThanOrEqual": "6.10"}, {"status": "unaffected", "version": "6.10", "versionType": "git", "lessThanOrEqual": "*"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "CWE-121 Stack-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-20T13:36:00.522Z"}}], "cna": {"title": "kdb: Fix buffer overflow during tab-complete", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5d5314d6795f3c1c0f415348ff8c51f7de042b77", "lessThan": "fb824a99e148ff272a53d71d84122728b5f00992", "versionType": "git"}, {"status": "affected", "version": "5d5314d6795f3c1c0f415348ff8c51f7de042b77", "lessThan": "ddd2972d8e2dee3b33e8121669d55def59f0be8a", "versionType": "git"}, {"status": "affected", "version": "5d5314d6795f3c1c0f415348ff8c51f7de042b77", "lessThan": "cfdc2fa4db57503bc6d3817240547c8ddc55fa96", "versionType": "git"}, {"status": "affected", "version": "5d5314d6795f3c1c0f415348ff8c51f7de042b77", "lessThan": "f636a40834d22e5e3fc748f060211879c056cd33", "versionType": "git"}, {"status": "affected", "version": "5d5314d6795f3c1c0f415348ff8c51f7de042b77", "lessThan": "33d9c814652b971461d1e30bead6792851c209e7", "versionType": "git"}, {"status": "affected", "version": "5d5314d6795f3c1c0f415348ff8c51f7de042b77", "lessThan": "107e825cc448b7834b31e8b1b3cf0f57426d46d5", "versionType": "git"}, {"status": "affected", "version": "5d5314d6795f3c1c0f415348ff8c51f7de042b77", "lessThan": "f694da720dcf795dc3eb97bf76d220213f76aaa7", "versionType": "git"}, {"status": "affected", "version": "5d5314d6795f3c1c0f415348ff8c51f7de042b77", "lessThan": "e9730744bf3af04cda23799029342aa3cddbc454", "versionType": "git"}], "programFiles": ["kernel/debug/kdb/kdb_io.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.35"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.35", "versionType": "semver"}, {"status": "unaffected", "version": "4.19.316", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.278", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.219", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.161", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.94", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.34", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.9.5", "versionType": "semver", "lessThanOrEqual": "6.9.*"}, {"status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["kernel/debug/kdb/kdb_io.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/fb824a99e148ff272a53d71d84122728b5f00992"}, {"url": "https://git.kernel.org/stable/c/ddd2972d8e2dee3b33e8121669d55def59f0be8a"}, {"url": "https://git.kernel.org/stable/c/cfdc2fa4db57503bc6d3817240547c8ddc55fa96"}, {"url": "https://git.kernel.org/stable/c/f636a40834d22e5e3fc748f060211879c056cd33"}, {"url": "https://git.kernel.org/stable/c/33d9c814652b971461d1e30bead6792851c209e7"}, {"url": "https://git.kernel.org/stable/c/107e825cc448b7834b31e8b1b3cf0f57426d46d5"}, {"url": "https://git.kernel.org/stable/c/f694da720dcf795dc3eb97bf76d220213f76aaa7"}, {"url": "https://git.kernel.org/stable/c/e9730744bf3af04cda23799029342aa3cddbc454"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkdb: Fix buffer overflow during tab-complete\n\nCurrently, when the user attempts symbol completion with the Tab key, kdb\nwill use strncpy() to insert the completed symbol into the command buffer.\nUnfortunately it passes the size of the source buffer rather than the\ndestination to strncpy() with predictably horrible results. Most obviously\nif the command buffer is already full but cp, the cursor position, is in\nthe middle of the buffer, then we will write past the end of the supplied\nbuffer.\n\nFix this by replacing the dubious strncpy() calls with memmove()/memcpy()\ncalls plus explicit boundary checks to make sure we have enough space\nbefore we start moving characters around."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.316", "versionStartIncluding": "2.6.35"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.278", "versionStartIncluding": "2.6.35"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.219", "versionStartIncluding": "2.6.35"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.161", "versionStartIncluding": "2.6.35"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.94", "versionStartIncluding": "2.6.35"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.34", "versionStartIncluding": "2.6.35"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9.5", "versionStartIncluding": "2.6.35"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10", "versionStartIncluding": "2.6.35"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-01-05T10:36:46.174Z"}}}, "cveMetadata": {"cveId": "CVE-2024-39480", "state": "PUBLISHED", "dateUpdated": "2026-01-05T10:36:46.174Z", "dateReserved": "2024-06-25T14:23:23.746Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-07-05T06:55:09.241Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/debug/kdb/kdb_io.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "fb824a99e148ff272a53d71d84122728b5f00992", "status": "affected", "version": "5d5314d6795f3c1c0f415348ff8c51f7de042b77", "versionType": "git"}, {"lessThan": "ddd2972d8e2dee3b33e8121669d55def59f0be8a", "status": "affected", "version": "5d5314d6795f3c1c0f415348ff8c51f7de042b77", "versionType": "git"}, {"lessThan": "cfdc2fa4db57503bc6d3817240547c8ddc55fa96", "status": "affected", "version": "5d5314d6795f3c1c0f415348ff8c51f7de042b77", "versionType": "git"}, {"lessThan": "f636a40834d22e5e3fc748f060211879c056cd33", "status": "affected", "version": "5d5314d6795f3c1c0f415348ff8c51f7de042b77", "versionType": "git"}, {"lessThan": "33d9c814652b971461d1e30bead6792851c209e7", "status": "affected", "version": "5d5314d6795f3c1c0f415348ff8c51f7de042b77", "versionType": "git"}, {"lessThan": "107e825cc448b7834b31e8b1b3cf0f57426d46d5", "status": "affected", "version": "5d5314d6795f3c1c0f415348ff8c51f7de042b77", "versionType": "git"}, {"lessThan": "f694da720dcf795dc3eb97bf76d220213f76aaa7", "status": "affected", "version": "5d5314d6795f3c1c0f415348ff8c51f7de042b77", "versionType": "git"}, {"lessThan": "e9730744bf3af04cda23799029342aa3cddbc454", "status": "affected", "version": "5d5314d6795f3c1c0f415348ff8c51f7de042b77", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/debug/kdb/kdb_io.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.35"}, {"lessThan": "2.6.35", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.316", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.278", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.219", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.161", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.94", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.34", "versionType": "semver"}, {"lessThanOrEqual": "6.9.*", "status": "unaffected", "version": "6.9.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"cpes": ["cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "linux_kernel", "vendor": "linux", "versions": [{"lessThan": "fb824a99e148", "status": "affected", "version": "1da177e4c3f4", "versionType": "git"}, {"lessThan": "ddd2972d8e2d", "status": "affected", "version": "1da177e4c3f4", "versionType": "git"}, {"lessThan": "cfdc2fa4db57", "status": "affected", "version": "1da177e4c3f4", "versionType": "git"}, {"lessThan": "f636a40834d2", "status": "affected", "version": "1da177e4c3f4", "versionType": "git"}, {"lessThan": "33d9c814652b", "status": "affected", "version": "1da177e4c3f4", "versionType": "git"}, {"lessThan": "107e825cc448", "status": "affected", "version": "1da177e4c3f4", "versionType": "git"}, {"lessThan": "f694da720dcf", "status": "affected", "version": "1da177e4c3f4", "versionType": "git"}, {"lessThan": "e9730744bf3a", "status": "affected", "version": "1da177e4c3f4", "versionType": "git"}, {"lessThanOrEqual": "4.20", "status": "unaffected", "version": "4.19.316", "versionType": "git"}, {"lessThanOrEqual": "5.5", "status": "unaffected", "version": "5.4.278", "versionType": "git"}, {"lessThanOrEqual": "5.11", "status": "unaffected", "version": "5.10.219", "versionType": "git"}, {"lessThanOrEqual": "5.16", "status": "unaffected", "version": "5.15.161", "versionType": "git"}, {"lessThanOrEqual": "6.2", "status": "unaffected", "version": "6.1.94", "versionType": "git"}, {"lessThanOrEqual": "6.7", "status": "unaffected", "version": "6.6.34", "versionType": "git"}, {"lessThanOrEqual": "6.10", "status": "unaffected", "version": "6.9.5", "versionType": "git"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.10", "versionType": "git"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "34445C8D-D7E6-4796-B792-C9257E89257B", "versionEndExcluding": "4.19.316", "versionStartIncluding": "4.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8E2371B0-4787-4038-B526-021D4CF93B31", "versionEndExcluding": "5.4.278", "versionStartIncluding": "5.4", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5311C980-4CDF-4C10-8875-F04ED0F03398", "versionEndExcluding": "5.10.219", "versionStartIncluding": "5.10", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E2AB5A01-EFFD-4A24-8CCB-4A016C8C4BB3", "versionEndExcluding": "5.15.161", "versionStartIncluding": "5.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B5A86346-2984-4261-AC12-29EACB186000", "versionEndExcluding": "6.1.94", "versionStartIncluding": "6.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "AC0C6E24-8240-425A-BD1A-F78E6D3A67FC", "versionEndExcluding": "6.6.34", "versionStartIncluding": "6.6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "54EDFD02-25E6-4BC8-9AD0-0A59881F400A", "versionEndExcluding": "6.9.5", "versionStartIncluding": "6.9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkdb: Fix buffer overflow during tab-complete\n\nCurrently, when the user attempts symbol completion with the Tab key, kdb\nwill use strncpy() to insert the completed symbol into the command buffer.\nUnfortunately it passes the size of the source buffer rather than the\ndestination to strncpy() with predictably horrible results. Most obviously\nif the command buffer is already full but cp, the cursor position, is in\nthe middle of the buffer, then we will write past the end of the supplied\nbuffer.\n\nFix this by replacing the dubious strncpy() calls with memmove()/memcpy()\ncalls plus explicit boundary checks to make sure we have enough space\nbefore we start moving characters around."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: kdb: corrige el desbordamiento del b\u00fafer durante la finalizaci\u00f3n de tabulaci\u00f3n Actualmente, cuando el usuario intenta completar el s\u00edmbolo con la tecla Tab, kdb usar\u00e1 strncpy() para insertar el s\u00edmbolo completado en el b\u00fafer de comando. Desafortunadamente, pasa el tama\u00f1o del b\u00fafer de origen en lugar del destino a strncpy() con resultados predeciblemente horribles. Lo m\u00e1s obvio es que si el b\u00fafer de comando ya est\u00e1 lleno pero cp, la posici\u00f3n del cursor, est\u00e1 en el medio del b\u00fafer, entonces escribiremos m\u00e1s all\u00e1 del final del b\u00fafer proporcionado. Solucione este problema reemplazando las dudosas llamadas strncpy() con llamadas memmove()/memcpy() m\u00e1s comprobaciones expl\u00edcitas de los l\u00edmites para asegurarnos de que tenemos suficiente espacio antes de comenzar a mover los personajes."}], "id": "CVE-2024-39480", "lastModified": "2026-08-04T11:18:58.420", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-39480", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-08-20T03:55:14.759316Z", "version": "2.0.3"}}]}, "published": "2024-07-05T07:15:10.590", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/107e825cc448b7834b31e8b1b3cf0f57426d46d5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/33d9c814652b971461d1e30bead6792851c209e7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/cfdc2fa4db57503bc6d3817240547c8ddc55fa96"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/ddd2972d8e2dee3b33e8121669d55def59f0be8a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/e9730744bf3af04cda23799029342aa3cddbc454"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/f636a40834d22e5e3fc748f060211879c056cd33"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/f694da720dcf795dc3eb97bf76d220213f76aaa7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/fb824a99e148ff272a53d71d84122728b5f00992"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/107e825cc448b7834b31e8b1b3cf0f57426d46d5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/33d9c814652b971461d1e30bead6792851c209e7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/cfdc2fa4db57503bc6d3817240547c8ddc55fa96"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/ddd2972d8e2dee3b33e8121669d55def59f0be8a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/e9730744bf3af04cda23799029342aa3cddbc454"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/f636a40834d22e5e3fc748f060211879c056cd33"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/f694da720dcf795dc3eb97bf76d220213f76aaa7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/fb824a99e148ff272a53d71d84122728b5f00992"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-120"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-121"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: kdb: Fix buffer overflow during tab-complete", "id": "2296056", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2296056"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-121", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nkdb: Fix buffer overflow during tab-complete\nCurrently, when the user attempts symbol completion with the Tab key, kdb\nwill use strncpy() to insert the completed symbol into the command buffer.\nUnfortunately it passes the size of the source buffer rather than the\ndestination to strncpy() with predictably horrible results. Most obviously\nif the command buffer is already full but cp, the cursor position, is in\nthe middle of the buffer, then we will write past the end of the supplied\nbuffer.\nFix this by replacing the dubious strncpy() calls with memmove()/memcpy()\ncalls plus explicit boundary checks to make sure we have enough space\nbefore we start moving characters around."], "name": "CVE-2024-39480", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-07-05T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-39480\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-39480\nhttps://lore.kernel.org/linux-cve-announce/2024070519-CVE-2024-39480-b85a@gregkh/T"], "threat_severity": "Low"}

{}