CVE-2024-26907

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-26907
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-26907.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-26907
Related
Published
2024-04-17T11:15:11Z
Modified
2024-11-05T10:50:01.562998Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mlx5: Fix fortify source warning while accessing Eth segment

------------[ cut here ]------------ memcpy: detected field-spanning write (size 56) of single field "eseg->inlinehdr.start" at /var/lib/dkms/mlnx-ofed-kernel/5.8/build/drivers/infiniband/hw/mlx5/wr.c:131 (size 2) WARNING: CPU: 0 PID: 293779 at /var/lib/dkms/mlnx-ofed-kernel/5.8/build/drivers/infiniband/hw/mlx5/wr.c:131 mlx5ibpostsend+0x191b/0x1a60 [mlx5ib] Modules linked in: 8021q garp mrp stp llc rdmaucm(OE) rdmacm(OE) iwcm(OE) ibipoib(OE) ibcm(OE) ibumad(OE) mlx5ib(OE) ibuverbs(OE) ibcore(OE) mlx5core(OE) pcihypervintf mlxdevm(OE) mlxcompat(OE) tls mlxfw(OE) psample nftfibinet nftfibipv4 nftfibipv6 nftfib nftrejectinet nfrejectipv4 nfrejectipv6 nftreject nftct nftchainnat nfnat nfconntrack nfdefragipv6 nfdefragipv4 ipset nftables libcrc32c nfnetlink mstpciconf(OE) knem(OE) vfiopci vfiopcicore vfioiommutype1 vfio iommufd irqbypass cuse nfsv3 nfs fscache netfs xfrmuser xfrmalgo ipmidevintf ipmimsghandler binfmtmisc crct10difpclmul crc32pclmul polyvalclmulni polyvalgeneric ghashclmulniintel sha512ssse3 sndpcsp aesniintel cryptosimd cryptd sndpcm sndtimer joydev snd soundcore inputleds serioraw evbug nfsd authrpcgss nfsacl lockd grace schfqcodel sunrpc drm efipstore iptables xtables autofs4 psmouse virtionet netfailover failover floppy [last unloaded: mlxcompat(OE)] CPU: 0 PID: 293779 Comm: ssh Tainted: G OE 6.2.0-32-generic #32~22.04.1-Ubuntu Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 RIP: 0010:mlx5ibpostsend+0x191b/0x1a60 [mlx5ib] Code: 0c 01 00 a8 01 75 25 48 8b 75 a0 b9 02 00 00 00 48 c7 c2 10 5b fd c0 48 c7 c7 80 5b fd c0 c6 05 57 0c 03 00 01 e8 95 4d 93 da <0f> 0b 44 8b 4d b0 4c 8b 45 c8 48 8b 4d c0 e9 49 fb ff ff 41 0f b7 RSP: 0018:ffffb5b48478b570 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffb5b48478b628 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffb5b48478b5e8 R13: ffff963a3c609b5e R14: ffff9639c3fbd800 R15: ffffb5b480475a80 FS: 00007fc03b444c80(0000) GS:ffff963a3dc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000556f46bdf000 CR3: 0000000006ac6003 CR4: 00000000003706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? showregs+0x72/0x90 ? mlx5ibpostsend+0x191b/0x1a60 [mlx5ib] ? _warn+0x8d/0x160 ? mlx5ibpostsend+0x191b/0x1a60 [mlx5ib] ? reportbug+0x1bb/0x1d0 ? handlebug+0x46/0x90 ? excinvalidop+0x19/0x80 ? asmexcinvalidop+0x1b/0x20 ? mlx5ibpostsend+0x191b/0x1a60 [mlx5ib] mlx5ibpostsendnodrain+0xb/0x20 [mlx5ib] ipoibsend+0x2ec/0x770 [ibipoib] ipoibstartxmit+0x5a0/0x770 [ibipoib] devhardstartxmit+0x8e/0x1e0 ? validatexmitskblist+0x4d/0x80 schdirectxmit+0x116/0x3a0 _devxmitskb+0x1fd/0x580 _devqueuexmit+0x284/0x6b0 ? _rawspinunlockirq+0xe/0x50 ? _flushwork.isra.0+0x20d/0x370 ? pushpseudoheader+0x17/0x40 [ibipoib] neighconnectedoutput+0xcd/0x110 ipfinishoutput2+0x179/0x480 ? _smpcallsinglequeue+0x61/0xa0 _ipfinishoutput+0xc3/0x190 ipfinishoutput+0x2e/0xf0 ipoutput+0x78/0x110 ? _pfxipfinishoutput+0x10/0x10 iplocalout+0x64/0x70 _ipqueuexmit+0x18a/0x460 ipqueuexmit+0x15/0x30 _tcptransmitskb+0x914/0x9c0 tcpwritexmit+0x334/0x8d0 tcppushone+0x3c/0x60 tcpsendmsglocked+0x2e1/0xac0 tcpsendmsg+0x2d/0x50 inetsendmsg+0x43/0x90 socksendmsg+0x68/0x80 sockwriteiter+0x93/0x100 vfswrite+0x326/0x3c0 ksyswrite+0xbd/0xf0 ? dosyscall64+0x69/0x90 _x64syswrite+0x19/0x30 dosyscall_ ---truncated---

References

Affected packages

Debian:11 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.10.216-1

Affected versions

5.*

5.10.46-4
5.10.46-5
5.10.70-1~bpo10+1
5.10.70-1
5.10.84-1
5.10.92-1~bpo10+1
5.10.92-1
5.10.92-2
5.10.103-1~bpo10+1
5.10.103-1
5.10.106-1
5.10.113-1
5.10.120-1~bpo10+1
5.10.120-1
5.10.127-1
5.10.127-2~bpo10+1
5.10.127-2
5.10.136-1
5.10.140-1
5.10.148-1
5.10.149-1
5.10.149-2
5.10.158-1
5.10.158-2
5.10.162-1
5.10.178-1
5.10.178-2
5.10.178-3
5.10.179-1
5.10.179-2
5.10.179-3
5.10.179-4
5.10.179-5
5.10.191-1
5.10.197-1
5.10.205-1
5.10.205-2
5.10.209-1
5.10.209-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.1.85-1

Affected versions

6.*

6.1.27-1
6.1.37-1
6.1.38-1
6.1.38-2~bpo11+1
6.1.38-2
6.1.38-3
6.1.38-4~bpo11+1
6.1.38-4
6.1.52-1
6.1.55-1~bpo11+1
6.1.55-1
6.1.64-1
6.1.66-1
6.1.67-1
6.1.69-1~bpo11+1
6.1.69-1
6.1.76-1~bpo11+1
6.1.76-1
6.1.82-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.7.12-1

Affected versions

6.*

6.1.27-1
6.1.37-1
6.1.38-1
6.1.38-2~bpo11+1
6.1.38-2
6.1.38-3
6.1.38-4~bpo11+1
6.1.38-4
6.1.52-1
6.1.55-1~bpo11+1
6.1.55-1
6.1.64-1
6.1.66-1
6.1.67-1
6.1.69-1~bpo11+1
6.1.69-1
6.1.76-1~bpo11+1
6.1.76-1
6.1.82-1
6.1.85-1
6.1.90-1~bpo11+1
6.1.90-1
6.1.94-1~bpo11+1
6.1.94-1
6.1.98-1
6.1.99-1
6.1.106-1
6.1.106-2
6.1.106-3
6.1.112-1
6.1.115-1
6.3.1-1~exp1
6.3.2-1~exp1
6.3.4-1~exp1
6.3.5-1~exp1
6.3.7-1~bpo12+1
6.3.7-1
6.3.11-1
6.4~rc6-1~exp1
6.4~rc7-1~exp1
6.4.1-1~exp1
6.4.4-1~bpo12+1
6.4.4-1
6.4.4-2
6.4.4-3~bpo12+1
6.4.4-3
6.4.11-1
6.4.13-1
6.5~rc4-1~exp1
6.5~rc6-1~exp1
6.5~rc7-1~exp1
6.5.1-1~exp1
6.5.3-1~bpo12+1
6.5.3-1
6.5.6-1
6.5.8-1
6.5.10-1~bpo12+1
6.5.10-1
6.5.13-1
6.6.3-1~exp1
6.6.4-1~exp1
6.6.7-1~exp1
6.6.8-1
6.6.9-1
6.6.11-1
6.6.13-1~bpo12+1
6.6.13-1
6.6.15-1
6.6.15-2
6.7-1~exp1
6.7.1-1~exp1
6.7.4-1~exp1
6.7.7-1
6.7.9-1
6.7.9-2
6.7.12-1~bpo12+1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}