udf: Fix preallocation discarding at indirect extent boundary (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.25 % · percentile 17 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Analyzed
Description
In the Linux kernel, the following vulnerability has been resolved: udf: Fix preallocation discarding at indirect extent boundary When preallocation extent is the first one in the extent block, the code would corrupt extent tree header instead. Fix the problem and use udf_delete_aext() for deleting extent to avoid some code duplication.
References
- https://git.kernel.org/stable/c/c8b6fa4511a7900db9fb0353b630d4d2ed1ba99c
- https://git.kernel.org/stable/c/7665857f88557c372da35534165721156756f77f
- https://git.kernel.org/stable/c/72f651c96c8aadf087fd782d551bf7db648a8c2e
- https://git.kernel.org/stable/c/4d835efd561dfb9bf5409f11f4ecd428d5d29226
- https://git.kernel.org/stable/c/1a075f4a549481ce6e8518d8379f193ccec6b746
- https://git.kernel.org/stable/c/63dbbd8f1499b0a161e701a04aa50148d60bd1f7
- https://git.kernel.org/stable/c/ae56d9a017724f130cf1a263dd82a78d2a6e3852
- https://git.kernel.org/stable/c/12a88f572d6d94b5c0b72e2d1782cc2e96ac06cf
- https://git.kernel.org/stable/c/cfe4c1b25dd6d2f056afc00b7c98bcb3dd0b1fc3
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2022-53825
- GCVE · GCVE-0-2022-48946
CERT-FR advisories
- CERTFR-2025-AVI-1057 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0024 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-1102 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-1048 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-1033 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0999 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*< 4.9.337cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.10 < 4.14.303cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.15 < 4.19.270cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.20 < 5.4.229cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.5 < 5.10.161cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.11 < 5.15.85cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.16 < 6.0.15cpe:2.3:o:linux:linux_kernel:6.1:*:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.1.1:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < c8b6fa4511a7900db9fb0353b630d4d2ed1ba99c ; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 7665857f88557c372da35534165721156756f77f ; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 72f651c96c8aadf087fd782d551bf7db648a8c2e ; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 4d835efd561dfb9bf5409f11f4ecd428d5d29226 ; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 1a075f4a549481ce6e8518d8379f193ccec6b746 ; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 63dbbd8f1499b0a161e701a04aa50148d60bd1f7 |
| Linux · Linux | affected 2.6.12 ; unaffected 0 < 2.6.12 ; unaffected 4.9.337 ≤ 4.9.* ; unaffected 4.14.303 ≤ 4.14.* ; unaffected 4.19.270 ≤ 4.19.* ; unaffected 5.4.229 ≤ 5.4.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |