kdb: Fix buffer overflow during tab-complete (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.27 % · percentile 19 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: kdb: Fix buffer overflow during tab-complete Currently, when the user attempts symbol completion with the Tab key, kdb will use strncpy() to insert the completed symbol into the command buffer. Unfortunately it passes the size of the source buffer rather than the destination to strncpy() with predictably horrible results. Most obviously if the command buffer is already full but cp, the cursor position, is in the middle of the buffer, then we will write past the end of the supplied buffer. Fix this by replacing the dubious strncpy() calls with memmove()/memcpy() calls plus explicit boundary checks to make sure we have enough space before we start moving characters around.
Weaknesses (CWE)
References
- https://git.kernel.org/stable/c/fb824a99e148ff272a53d71d84122728b5f00992
- https://git.kernel.org/stable/c/ddd2972d8e2dee3b33e8121669d55def59f0be8a
- https://git.kernel.org/stable/c/cfdc2fa4db57503bc6d3817240547c8ddc55fa96
- https://git.kernel.org/stable/c/f636a40834d22e5e3fc748f060211879c056cd33
- https://git.kernel.org/stable/c/33d9c814652b971461d1e30bead6792851c209e7
- https://git.kernel.org/stable/c/107e825cc448b7834b31e8b1b3cf0f57426d46d5
- https://git.kernel.org/stable/c/f694da720dcf795dc3eb97bf76d220213f76aaa7
- https://git.kernel.org/stable/c/e9730744bf3af04cda23799029342aa3cddbc454
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.4 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | Linux |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
| CVSS 3.1 | HIGH 8.4 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
European references
- ENISA EUVD · EUVD-2024-38005
- GCVE · GCVE-0-2024-39480
CERT-FR advisories
- CERTFR-2025-AVI-0088 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0071 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0047 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0906 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0823 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0799 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0778 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0716 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0694 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0667 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0613 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.19 < 4.19.316cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.4 < 5.4.278cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.10 < 5.10.219cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.15 < 5.15.161cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.1 < 6.1.94cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.6 < 6.6.34cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.9 < 6.9.5
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 5d5314d6795f3c1c0f415348ff8c51f7de042b77 < fb824a99e148ff272a53d71d84122728b5f00992 ; affected 5d5314d6795f3c1c0f415348ff8c51f7de042b77 < ddd2972d8e2dee3b33e8121669d55def59f0be8a ; affected 5d5314d6795f3c1c0f415348ff8c51f7de042b77 < cfdc2fa4db57503bc6d3817240547c8ddc55fa96 ; affected 5d5314d6795f3c1c0f415348ff8c51f7de042b77 < f636a40834d22e5e3fc748f060211879c056cd33 ; affected 5d5314d6795f3c1c0f415348ff8c51f7de042b77 < 33d9c814652b971461d1e30bead6792851c209e7 ; affected 5d5314d6795f3c1c0f415348ff8c51f7de042b77 < 107e825cc448b7834b31e8b1b3cf0f57426d46d5 |
| Linux · Linux | affected 2.6.35 ; unaffected 0 < 2.6.35 ; unaffected 4.19.316 ≤ 4.19.* ; unaffected 5.4.278 ≤ 5.4.* ; unaffected 5.10.219 ≤ 5.10.* ; unaffected 5.15.161 ≤ 5.15.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |