9.1

CVE-2024-35845

wifi: iwlwifi: dbg-tlv: ensure NUL termination

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: dbg-tlv: ensure NUL termination

The iwl_fw_ini_debug_info_tlv is used as a string, so we must
ensure the string is terminated correctly before using it.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 5.5 < 5.10.214
Linux ≫ Linux Kernel Version >= 5.11 < 5.15.153
Linux ≫ Linux Kernel Version >= 5.16 < 6.1.83
Linux ≫ Linux Kernel Version >= 6.2 < 6.6.23
Linux ≫ Linux Kernel Version >= 6.7 < 6.7.11
Linux ≫ Linux Kernel Version >= 6.8 < 6.8.2
Debian ≫ Debian Linux Version10.0
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.17% 0.633
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0 9.1 3.9 5.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CWE-134 Use of Externally-Controlled Format String

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
Third Party Advisory
Mailing List
https://git.kernel.org/stable/c/71d4186d470e9cda7cd1a0921b4afda737c6f641
Patch
https://git.kernel.org/stable/c/783d413f332a3ebec916664b366c28f58147f82c
Patch
https://git.kernel.org/stable/c/96aa40761673da045a7774f874487cdb50c6a2f7
Patch
https://git.kernel.org/stable/c/c855a1a5b7e3de57e6b1b29563113d5e3bfdb89a
Patch
https://git.kernel.org/stable/c/ea1d166fae14e05d49ffb0ea9fcd4658f8d3dcea
Patch
https://git.kernel.org/stable/c/fabe2db7de32a881e437ee69db32e0de785a6209
Patch
https://git.kernel.org/stable/c/fec14d1cdd92f340b9ba2bd220abf96f9609f2a9
Patch
https://cert-portal.siemens.com/productcert/html/ssa-265688.html