6.7

CVE-2024-42642

Exploit
Micron Crucial MX500 Series Solid State Drives M3CR046 is vulnerable to Buffer Overflow, which can be triggered by sending specially crafted ATA packets from the host to the drive controller. NOTE: The supplier states that this vulnerability was fully remediated in December 2024 and that updated firmware is available through Crucial’s official support page.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Crucial ≫ Mx500 Firmware Version m3cr046
   Crucial ≫ Ct1000mx500ssd1 Version -
   Crucial ≫ Ct2000mx500ssd1 Version -
   Crucial ≫ Ct250mx500ssd1 Version -
   Crucial ≫ Ct4000mx500ssd1 Version -
   Crucial ≫ Ct500mx500ssd1 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.49% 0.395
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.7 0.8 5.9
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CISA-ADP 6.7 0.8 5.9
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

https://github.com/VL4DR/CVE-2024-42642/tree/main
Third Party Advisory
Exploit
https://www.crucial.com/support/ssd-support/mx500-support