xfs: validate attr entry pointer before field access
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux | unaffected |
|
||||||||||||||||||||||||||||||||||||
| Linux | Linux | affected |
|
No data.
No data.
| Vendor | Product | Versions | ||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux Kernel |
|
||||||||||||||||||||||||||||||||||||||||||||
| Linux | Linux Kernel |
|
| Source | ID | Title |
|---|---|---|
Debian DLA |
DLA-4777-1 | linux security update |
Debian DLA |
DLA-4788-1 | linux-6.12 security update |
Ubuntu USN |
USN-8961-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-9019-1 | Linux kernel (Azure) vulnerabilities |
Ubuntu USN |
USN-9020-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-9022-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-9023-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-9024-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-9025-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-9026-1 | Linux kernel (Azure) vulnerabilities |
Ubuntu USN |
USN-9029-1 | Linux kernel (Raspberry Pi) vulnerabilities |
Ubuntu USN |
USN-9039-1 | Linux kernel (Azure CVM) vulnerabilities |
Ubuntu USN |
USN-9040-1 | Linux kernel (Low Latency NVIDIA) vulnerabilities |
Ubuntu USN |
USN-9066-1 | Linux kernel (HWE) vulnerabilities |
Ubuntu USN |
USN-9091-1 | Linux kernel (NVIDIA Tegra) vulnerabilities |
No CVSS v4.0
No CVSS v3.1
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.195% probability within 30 days)
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-125 CWE-20 |
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In the Linux kernel, the following vulnerability has been resolved: xfs: validate attr entry pointer before field access xfs_attr3_leaf_verify_entry() accesses lentry/rentry fields (namelen, valuelen) before checking if the entry pointer itself is within bounds. If nameidx is crafted to point near the end of the buffer, these field accesses can read out-of-bounds before the bounds check at name_end > buf_end is performed. Add explicit bounds checks for entry pointers before accessing their fields. Use offsetof() to check that the start of the flexible array member (nameval/name) is within bounds, which ensures all preceding fields are safe to access. | |
| Title | xfs: validate attr entry pointer before field access | |
| First Time appeared |
Linux
Linux linux Kernel |
|
| CPEs | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Linux
Linux linux Kernel |
|
| References |
|
|