7.8

CVE-2024-0646

Kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination

An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security functionality in how a user calls a function splice with a ktls socket as the destination. This flaw allows a local user to crash or potentially escalate their privileges on the system.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 4.20 < 5.4.267
Linux ≫ Linux Kernel Version >= 5.5 < 5.10.208
Linux ≫ Linux Kernel Version >= 5.11 < 5.15.147
Linux ≫ Linux Kernel Version >= 5.16 < 6.1.69
Linux ≫ Linux Kernel Version >= 6.2 < 6.6.7
Linux ≫ Linux Kernel Version6.7 Updaterc1
Linux ≫ Linux Kernel Version6.7 Updaterc2
Linux ≫ Linux Kernel Version6.7 Updaterc3
Linux ≫ Linux Kernel Version6.7 Updaterc4
Redhat ≫ Enterprise Linux Version8.0
Redhat ≫ Enterprise Linux Version9.0
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.02% 0.046
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
secalert@redhat.com 7 1 5.9
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.