CVE-2024-44966

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-44966", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-08-21T05:34:56.667Z", "datePublished": "2024-09-04T18:38:45.625Z", "dateUpdated": "2026-08-05T11:37:20.222Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:37:20.222Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinfmt_flat: Fix corruption when not offsetting data start\n\nCommit 04d82a6d0881 (\"binfmt_flat: allow not offsetting data start\")\nintroduced a RISC-V specific variant of the FLAT format which does\nnot allocate any space for the (obsolete) array of shared library\npointers. However, it did not disable the code which initializes the\narray, resulting in the corruption of sizeof(long) bytes before the DATA\nsegment, generally the end of the TEXT segment.\n\nIntroduce MAX_SHARED_LIBS_UPDATE which depends on the state of\nCONFIG_BINFMT_FLAT_NO_DATA_START_OFFSET to guard the initialization of\nthe shared library pointer region so that it will only be initialized\nif space is reserved for it."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is triggered by execve() of an attacker-supplied bFLT file, requiring local access to the system. There is no network-facing path into binfmt_flat.\nAC:L - The defective loop runs unconditionally on every flat-binary load on an affected kernel, and the attacker fully controls the flat header fields (notably data_start) that place the write below the allocation base. No race, no unpredictable state, and success is deterministic on every attempt.\nPR:L - Any unprivileged local user who can write and exec a file reaches load_flat_binary(); binfmt_flat performs no capability or credential check beyond ordinary execute permission. No root or user-namespace trickery is needed.\nUI:N - The attacker executes their own crafted binary directly; no other user or victim action is involved in reaching the vulnerable code.\nS:U - The out-of-bounds write corrupts memory managed by the same kernel that is exploited; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The value stored is a kernel address (datapos) written into memory outside the process's allocation, which on a no-MMU flat address space can be read by whatever else owns that page, and the corruption primitive can be leveraged against adjacent structures for broader disclosure.\nI:H - This is an out-of-bounds write of a pointer-sized value below the start of an alloc_pages_exact() allocation with put_user() unchecked on nommu, corrupting adjacent kernel-owned memory; even in the benign case it silently rewrites the loaded executable's TEXT.\nA:H - Corrupting the word preceding a buddy-allocated page damages arbitrary neighbouring kernel data and can panic the system, and in the in-image case it corrupts the executing program's code so it faults. Any local user can repeat it at will."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/binfmt_flat.c"], "versions": [{"version": "04d82a6d0881ef1ab1e9f66f10805177ee2fb1e8", "lessThan": "3a684499261d0f7ed5ee72793025c88c2276809c", "status": "affected", "versionType": "git"}, {"version": "04d82a6d0881ef1ab1e9f66f10805177ee2fb1e8", "lessThan": "af65d5383854cc3f172a7d0843b628758bf462c8", "status": "affected", "versionType": "git"}, {"version": "04d82a6d0881ef1ab1e9f66f10805177ee2fb1e8", "lessThan": "49df34d2b7da9e57c839555a2f7877291ce45ad1", "status": "affected", "versionType": "git"}, {"version": "04d82a6d0881ef1ab1e9f66f10805177ee2fb1e8", "lessThan": "9350ba06ee61db392c486716ac68ecc20e030f7c", "status": "affected", "versionType": "git"}, {"version": "04d82a6d0881ef1ab1e9f66f10805177ee2fb1e8", "lessThan": "3eb3cd5992f7a0c37edc8d05b4c38c98758d8671", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/binfmt_flat.c"], "versions": [{"version": "5.13", "status": "affected"}, {"version": "0", "lessThan": "5.13", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.165", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.106", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.47", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10.6", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "5.15.165"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.1.106"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.6.47"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.10.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.11"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3a684499261d0f7ed5ee72793025c88c2276809c"}, {"url": "https://git.kernel.org/stable/c/af65d5383854cc3f172a7d0843b628758bf462c8"}, {"url": "https://git.kernel.org/stable/c/49df34d2b7da9e57c839555a2f7877291ce45ad1"}, {"url": "https://git.kernel.org/stable/c/9350ba06ee61db392c486716ac68ecc20e030f7c"}, {"url": "https://git.kernel.org/stable/c/3eb3cd5992f7a0c37edc8d05b4c38c98758d8671"}], "title": "binfmt_flat: Fix corruption when not offsetting data start", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-44966", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:39:30.735328Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-12T17:33:35.153Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:14:13.583Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:14:13.583Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-44966", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:39:30.735328Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:27.519Z"}}], "cna": {"title": "binfmt_flat: Fix corruption when not offsetting data start", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "04d82a6d0881ef1ab1e9f66f10805177ee2fb1e8", "lessThan": "3a684499261d0f7ed5ee72793025c88c2276809c", "versionType": "git"}, {"status": "affected", "version": "04d82a6d0881ef1ab1e9f66f10805177ee2fb1e8", "lessThan": "af65d5383854cc3f172a7d0843b628758bf462c8", "versionType": "git"}, {"status": "affected", "version": "04d82a6d0881ef1ab1e9f66f10805177ee2fb1e8", "lessThan": "49df34d2b7da9e57c839555a2f7877291ce45ad1", "versionType": "git"}, {"status": "affected", "version": "04d82a6d0881ef1ab1e9f66f10805177ee2fb1e8", "lessThan": "9350ba06ee61db392c486716ac68ecc20e030f7c", "versionType": "git"}, {"status": "affected", "version": "04d82a6d0881ef1ab1e9f66f10805177ee2fb1e8", "lessThan": "3eb3cd5992f7a0c37edc8d05b4c38c98758d8671", "versionType": "git"}], "programFiles": ["fs/binfmt_flat.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.13"}, {"status": "unaffected", "version": "0", "lessThan": "5.13", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.165", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.106", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.47", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.10.6", "versionType": "semver", "lessThanOrEqual": "6.10.*"}, {"status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/binfmt_flat.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/3a684499261d0f7ed5ee72793025c88c2276809c"}, {"url": "https://git.kernel.org/stable/c/af65d5383854cc3f172a7d0843b628758bf462c8"}, {"url": "https://git.kernel.org/stable/c/49df34d2b7da9e57c839555a2f7877291ce45ad1"}, {"url": "https://git.kernel.org/stable/c/9350ba06ee61db392c486716ac68ecc20e030f7c"}, {"url": "https://git.kernel.org/stable/c/3eb3cd5992f7a0c37edc8d05b4c38c98758d8671"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinfmt_flat: Fix corruption when not offsetting data start\n\nCommit 04d82a6d0881 (\"binfmt_flat: allow not offsetting data start\")\nintroduced a RISC-V specific variant of the FLAT format which does\nnot allocate any space for the (obsolete) array of shared library\npointers. However, it did not disable the code which initializes the\narray, resulting in the corruption of sizeof(long) bytes before the DATA\nsegment, generally the end of the TEXT segment.\n\nIntroduce MAX_SHARED_LIBS_UPDATE which depends on the state of\nCONFIG_BINFMT_FLAT_NO_DATA_START_OFFSET to guard the initialization of\nthe shared library pointer region so that it will only be initialized\nif space is reserved for it."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.165", "versionStartIncluding": "5.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.106", "versionStartIncluding": "5.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.47", "versionStartIncluding": "5.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10.6", "versionStartIncluding": "5.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.11", "versionStartIncluding": "5.13"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T20:32:52.997Z"}}}, "cveMetadata": {"cveId": "CVE-2024-44966", "state": "PUBLISHED", "dateUpdated": "2026-05-11T20:32:52.997Z", "dateReserved": "2024-08-21T05:34:56.667Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-09-04T18:38:45.625Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/binfmt_flat.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3a684499261d0f7ed5ee72793025c88c2276809c", "status": "affected", "version": "04d82a6d0881ef1ab1e9f66f10805177ee2fb1e8", "versionType": "git"}, {"lessThan": "af65d5383854cc3f172a7d0843b628758bf462c8", "status": "affected", "version": "04d82a6d0881ef1ab1e9f66f10805177ee2fb1e8", "versionType": "git"}, {"lessThan": "49df34d2b7da9e57c839555a2f7877291ce45ad1", "status": "affected", "version": "04d82a6d0881ef1ab1e9f66f10805177ee2fb1e8", "versionType": "git"}, {"lessThan": "9350ba06ee61db392c486716ac68ecc20e030f7c", "status": "affected", "version": "04d82a6d0881ef1ab1e9f66f10805177ee2fb1e8", "versionType": "git"}, {"lessThan": "3eb3cd5992f7a0c37edc8d05b4c38c98758d8671", "status": "affected", "version": "04d82a6d0881ef1ab1e9f66f10805177ee2fb1e8", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/binfmt_flat.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.13"}, {"lessThan": "5.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.106", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.47", "versionType": "semver"}, {"lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C9AF5ED3-AC3F-4864-B907-F7C809A8995E", "versionEndExcluding": "5.15.165", "versionStartIncluding": "5.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "3F3AF3DA-1553-4AB8-97CC-7D0C91E4E23F", "versionEndExcluding": "6.1.106", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F450D4D2-61CE-4595-B7D1-CA382E2028E9", "versionEndExcluding": "6.6.47", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C1CDF130-CCA6-47F6-9718-8949BF4E05CC", "versionEndExcluding": "6.10.6", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*", "matchCriteriaId": "8B3CE743-2126-47A3-8B7C-822B502CF119", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*", "matchCriteriaId": "4DEB27E7-30AA-45CC-8934-B89263EF3551", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*", "matchCriteriaId": "E0005AEF-856E-47EB-BFE4-90C46899394D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinfmt_flat: Fix corruption when not offsetting data start\n\nCommit 04d82a6d0881 (\"binfmt_flat: allow not offsetting data start\")\nintroduced a RISC-V specific variant of the FLAT format which does\nnot allocate any space for the (obsolete) array of shared library\npointers. However, it did not disable the code which initializes the\narray, resulting in the corruption of sizeof(long) bytes before the DATA\nsegment, generally the end of the TEXT segment.\n\nIntroduce MAX_SHARED_LIBS_UPDATE which depends on the state of\nCONFIG_BINFMT_FLAT_NO_DATA_START_OFFSET to guard the initialization of\nthe shared library pointer region so that it will only be initialized\nif space is reserved for it."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: binfmt_flat: Se corrige la corrupci\u00f3n cuando no se compensa el inicio de los datos. El commit 04d82a6d0881 (\"binfmt_flat: permitir no compensar el inicio de los datos\") introdujo una variante espec\u00edfica de RISC-V del formato FLAT que no asigna ning\u00fan espacio para la matriz (obsoleta) de punteros de librer\u00eda compartida. Sin embargo, no deshabilit\u00f3 el c\u00f3digo que inicializa la matriz, lo que result\u00f3 en la corrupci\u00f3n de sizeof(long) bytes antes del segmento DATA, generalmente el final del segmento TEXT. Introduzca MAX_SHARED_LIBS_UPDATE que depende del estado de CONFIG_BINFMT_FLAT_NO_DATA_START_OFFSET para proteger la inicializaci\u00f3n de la regi\u00f3n del puntero de la librer\u00eda compartida de modo que solo se inicialice si se reserva espacio para ella."}], "id": "CVE-2024-44966", "lastModified": "2026-08-04T11:20:04.553", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-44966", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T17:39:30.735328Z", "version": "2.0.3"}}]}, "published": "2024-09-04T19:15:31.060", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3a684499261d0f7ed5ee72793025c88c2276809c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3eb3cd5992f7a0c37edc8d05b4c38c98758d8671"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/49df34d2b7da9e57c839555a2f7877291ce45ad1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9350ba06ee61db392c486716ac68ecc20e030f7c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/af65d5383854cc3f172a7d0843b628758bf462c8"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: binfmt_flat: Fix corruption when not offsetting data start", "id": "2309797", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2309797"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", "status": "draft"}, "cwe": "CWE-119", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbinfmt_flat: Fix corruption when not offsetting data start\nCommit 04d82a6d0881 (\"binfmt_flat: allow not offsetting data start\")\nintroduced a RISC-V specific variant of the FLAT format which does\nnot allocate any space for the (obsolete) array of shared library\npointers. However, it did not disable the code which initializes the\narray, resulting in the corruption of sizeof(long) bytes before the DATA\nsegment, generally the end of the TEXT segment.\nIntroduce MAX_SHARED_LIBS_UPDATE which depends on the state of\nCONFIG_BINFMT_FLAT_NO_DATA_START_OFFSET to guard the initialization of\nthe shared library pointer region so that it will only be initialized\nif space is reserved for it."], "name": "CVE-2024-44966", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-09-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-44966\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-44966\nhttps://lore.kernel.org/linux-cve-announce/2024090449-CVE-2024-44966-3aac@gregkh/T"], "threat_severity": "Moderate"}

{}