CVE-2024-39480

HIGH

Linux Kernel < 4.19.316 - Buffer Overflow

Title source: rule
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: kdb: Fix buffer overflow during tab-complete Currently, when the user attempts symbol completion with the Tab key, kdb will use strncpy() to insert the completed symbol into the command buffer. Unfortunately it passes the size of the source buffer rather than the destination to strncpy() with predictably horrible results. Most obviously if the command buffer is already full but cp, the cursor position, is in the middle of the buffer, then we will write past the end of the supplied buffer. Fix this by replacing the dubious strncpy() calls with memmove()/memcpy() calls plus explicit boundary checks to make sure we have enough space before we start moving characters around.

Scores

CVSS v3 7.8
EPSS 0.0002
EPSS Percentile 5.7%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-121 CWE-120
Status published
Products (8)
linux/Kernel 2.6.35 - 4.19.316linux
linux/Kernel 4.20.0 - 5.4.278linux
linux/Kernel 5.11.0 - 5.15.161linux
linux/Kernel 5.16.0 - 6.1.94linux
linux/Kernel 5.5.0 - 5.10.219linux
linux/Kernel 6.2.0 - 6.6.34linux
linux/Kernel 6.7.0 - 6.9.5linux
linux/linux_kernel 4.19 - 4.19.316
Published Jul 05, 2024
Tracked Since Feb 18, 2026