{"id":"CVE-2024-56548","state":"PUBLISHED","title":"hfsplus: don't query the device logical block size multiple times","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: don't query the device logical block size multiple times\n\nDevices block sizes may change. One of these cases is a loop device by\nusing ioctl LOOP_SET_BLOCK_SIZE.\n\nWhile this may cause other issues like IO being rejected, in the case of\nhfsplus, it will allocate a block by using that size and potentially write\nout-of-bounds when hfsplus_read_wrapper calls hfsplus_submit_bio and the\nlatter function reads a different io_size.\n\nUsing a new min_io_size initally set to sb_min_blocksize works for the\npurposes of the original fix, since it will be set to the max between\nHFSPLUS_SECTOR_SIZE and the first seen logical block size. We still use the\nmax between HFSPLUS_SECTOR_SIZE and min_io_size in case the latter is not\ninitialized.\n\nTested by mounting an hfsplus filesystem with loop block sizes 512, 1024\nand 4096.\n\nThe produced KASAN report before the fix looks like this:\n\n[  419.944641] ==================================================================\n[  419.945655] BUG: KASAN: slab-use-after-free in hfsplus_read_wrapper+0x659/0xa0a\n[  419.946703] Read of size 2 at addr ffff88800721fc00 by task repro/10678\n[  419.947612]\n[  419.947846] CPU: 0 UID: 0 PID: 10678 Comm: repro Not tainted 6.12.0-rc5-00008-gdf56e0f2f3ca #84\n[  419.949007] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014\n[  419.950035] Call Trace:\n[  419.950384]  <TASK>\n[  419.950676]  dump_stack_lvl+0x57/0x78\n[  419.951212]  ? hfsplus_read_wrapper+0x659/0xa0a\n[  419.951830]  print_report+0x14c/0x49e\n[  419.952361]  ? __virt_addr_valid+0x267/0x278\n[  419.952979]  ? kmem_cache_debug_flags+0xc/0x1d\n[  419.953561]  ? hfsplus_read_wrapper+0x659/0xa0a\n[  419.954231]  kasan_report+0x89/0xb0\n[  419.954748]  ? hfsplus_read_wrapper+0x659/0xa0a\n[  419.955367]  hfsplus_read_wrapper+0x659/0xa0a\n[  419.955948]  ? __pfx_hfsplus_read_wrapper+0x10/0x10\n[  419.956618]  ? do_raw_spin_unlock+0x59/0x1a9\n[  419.957214]  ? _raw_spin_unlock+0x1a/0x2e\n[  419.957772]  hfsplus_fill_super+0x348/0x1590\n[  419.958355]  ? hlock_class+0x4c/0x109\n[  419.958867]  ? __pfx_hfsplus_fill_super+0x10/0x10\n[  419.959499]  ? __pfx_string+0x10/0x10\n[  419.960006]  ? lock_acquire+0x3e2/0x454\n[  419.960532]  ? bdev_name.constprop.0+0xce/0x243\n[  419.961129]  ? __pfx_bdev_name.constprop.0+0x10/0x10\n[  419.961799]  ? pointer+0x3f0/0x62f\n[  419.962277]  ? __pfx_pointer+0x10/0x10\n[  419.962761]  ? vsnprintf+0x6c4/0xfba\n[  419.963178]  ? __pfx_vsnprintf+0x10/0x10\n[  419.963621]  ? setup_bdev_super+0x376/0x3b3\n[  419.964029]  ? snprintf+0x9d/0xd2\n[  419.964344]  ? __pfx_snprintf+0x10/0x10\n[  419.964675]  ? lock_acquired+0x45c/0x5e9\n[  419.965016]  ? set_blocksize+0x139/0x1c1\n[  419.965381]  ? sb_set_blocksize+0x6d/0xae\n[  419.965742]  ? __pfx_hfsplus_fill_super+0x10/0x10\n[  419.966179]  mount_bdev+0x12f/0x1bf\n[  419.966512]  ? __pfx_mount_bdev+0x10/0x10\n[  419.966886]  ? vfs_parse_fs_string+0xce/0x111\n[  419.967293]  ? __pfx_vfs_parse_fs_string+0x10/0x10\n[  419.967702]  ? __pfx_hfsplus_mount+0x10/0x10\n[  419.968073]  legacy_get_tree+0x104/0x178\n[  419.968414]  vfs_get_tree+0x86/0x296\n[  419.968751]  path_mount+0xba3/0xd0b\n[  419.969157]  ? __pfx_path_mount+0x10/0x10\n[  419.969594]  ? kmem_cache_free+0x1e2/0x260\n[  419.970311]  do_mount+0x99/0xe0\n[  419.970630]  ? __pfx_do_mount+0x10/0x10\n[  419.971008]  __do_sys_mount+0x199/0x1c9\n[  419.971397]  do_syscall_64+0xd0/0x135\n[  419.971761]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[  419.972233] RIP: 0033:0x7c3cb812972e\n[  419.972564] Code: 48 8b 0d f5 46 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c2 46 0d 00 f7 d8 64 89 01 48\n[  419.974371] RSP: 002b:00007ffe30632548 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5\n[  419.975048] RAX: ffffffffffffffda RBX: 00007ffe306328d8 RCX: 00007c3cb812972e\n[  419.975701] RDX: 0000000020000000 RSI: 0000000020000c80 RDI:\n---truncated---","publishedAt":"2024-12-27T14:11:29.373Z","updatedAt":"2026-08-05T11:44:57.408Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"6596528e391ad978a6a120142cba97a1d7324cb6","status":"affected","lessThan":"baccb5e12577b7a9eff54ffba301fdaa0f3ee5a8","versionType":"git"},{"version":"6596528e391ad978a6a120142cba97a1d7324cb6","status":"affected","lessThan":"f57725bcc5816425e25218fdf5fb6923bc578cdf","versionType":"git"},{"version":"6596528e391ad978a6a120142cba97a1d7324cb6","status":"affected","lessThan":"e8a2b1c1c2ea85e9a5a2d0c5a5a7e7c639feb866","versionType":"git"},{"version":"6596528e391ad978a6a120142cba97a1d7324cb6","status":"affected","lessThan":"06cbfbb13ac88f4154c2eb4bc4176f9d10139847","versionType":"git"},{"version":"6596528e391ad978a6a120142cba97a1d7324cb6","status":"affected","lessThan":"3d7bda75e1a6239db053c73acde17ca146317824","versionType":"git"},{"version":"6596528e391ad978a6a120142cba97a1d7324cb6","status":"affected","lessThan":"21900e8478126ff6afe3b66679f676e74d1f8830","versionType":"git"},{"version":"6596528e391ad978a6a120142cba97a1d7324cb6","status":"affected","lessThan":"2667c9b7b76efcbc7adbfea249892f20c313b0da","versionType":"git"},{"version":"6596528e391ad978a6a120142cba97a1d7324cb6","status":"affected","lessThan":"bfeecda050aa9376f642d5b2a71c4112cc6c8216","versionType":"git"},{"version":"6596528e391ad978a6a120142cba97a1d7324cb6","status":"affected","lessThan":"1c82587cb57687de3f18ab4b98a8850c789bedcf","versionType":"git"},{"version":"c53c89aba3ebdfc3e9acdb18bb5ee9d2f8a328d0","status":"affected","versionType":"git"},{"version":"3.0.8","status":"affected","lessThan":"3.1","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/hfsplus/hfsplus_fs.h","fs/hfsplus/wrapper.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.1","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.1","versionType":"semver"},{"version":"4.19.325","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.287","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.231","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.174","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.120","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.64","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.11.11","status":"unaffected","lessThanOrEqual":"6.11.*","versionType":"semver"},{"version":"6.12.2","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.13","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/hfsplus/hfsplus_fs.h","fs/hfsplus/wrapper.c"]}],"references":["https://git.kernel.org/stable/c/baccb5e12577b7a9eff54ffba301fdaa0f3ee5a8","https://git.kernel.org/stable/c/f57725bcc5816425e25218fdf5fb6923bc578cdf","https://git.kernel.org/stable/c/e8a2b1c1c2ea85e9a5a2d0c5a5a7e7c639feb866","https://git.kernel.org/stable/c/06cbfbb13ac88f4154c2eb4bc4176f9d10139847","https://git.kernel.org/stable/c/3d7bda75e1a6239db053c73acde17ca146317824","https://git.kernel.org/stable/c/21900e8478126ff6afe3b66679f676e74d1f8830","https://git.kernel.org/stable/c/2667c9b7b76efcbc7adbfea249892f20c313b0da","https://git.kernel.org/stable/c/bfeecda050aa9376f642d5b2a71c4112cc6c8216","https://git.kernel.org/stable/c/1c82587cb57687de3f18ab4b98a8850c789bedcf","https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html","https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"],"weaknesses":["CWE-787"],"ingestedAt":"2026-10-29T20:08:12.933Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/56xxx/CVE-2024-56548.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-56548","state":"PUBLISHED","datePublished":"2024-12-27T14:11:29.373Z","dateUpdated":"2026-08-05T11:44:57.408Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-12-27T14:03:05.989Z"},"containers":{"cna":{"title":"hfsplus: don't query the device logical block size multiple times","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: don't query the device logical block size multiple times\n\nDevices block sizes may change. One of these cases is a loop device by\nusing ioctl LOOP_SET_BLOCK_SIZE.\n\nWhile this may cause other issues like IO being rejected, in the case of\nhfsplus, it will allocate a block by using that size and potentially write\nout-of-bounds when hfsplus_read_wrapper calls hfsplus_submit_bio and the\nlatter function reads a different io_size.\n\nUsing a new min_io_size initally set to sb_min_blocksize works for the\npurposes of the original fix, since it will be set to the max between\nHFSPLUS_SECTOR_SIZE and the first seen logical block size. We still use the\nmax between HFSPLUS_SECTOR_SIZE and min_io_size in case the latter is not\ninitialized.\n\nTested by mounting an hfsplus filesystem with loop block sizes 512, 1024\nand 4096.\n\nThe produced KASAN report before the fix looks like this:\n\n[  419.944641] ==================================================================\n[  419.945655] BUG: KASAN: slab-use-after-free in hfsplus_read_wrapper+0x659/0xa0a\n[  419.946703] Read of size 2 at addr ffff88800721fc00 by task repro/10678\n[  419.947612]\n[  419.947846] CPU: 0 UID: 0 PID: 10678 Comm: repro Not tainted 6.12.0-rc5-00008-gdf56e0f2f3ca #84\n[  419.949007] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014\n[  419.950035] Call Trace:\n[  419.950384]  <TASK>\n[  419.950676]  dump_stack_lvl+0x57/0x78\n[  419.951212]  ? hfsplus_read_wrapper+0x659/0xa0a\n[  419.951830]  print_report+0x14c/0x49e\n[  419.952361]  ? __virt_addr_valid+0x267/0x278\n[  419.952979]  ? kmem_cache_debug_flags+0xc/0x1d\n[  419.953561]  ? hfsplus_read_wrapper+0x659/0xa0a\n[  419.954231]  kasan_report+0x89/0xb0\n[  419.954748]  ? hfsplus_read_wrapper+0x659/0xa0a\n[  419.955367]  hfsplus_read_wrapper+0x659/0xa0a\n[  419.955948]  ? __pfx_hfsplus_read_wrapper+0x10/0x10\n[  419.956618]  ? do_raw_spin_unlock+0x59/0x1a9\n[  419.957214]  ? _raw_spin_unlock+0x1a/0x2e\n[  419.957772]  hfsplus_fill_super+0x348/0x1590\n[  419.958355]  ? hlock_class+0x4c/0x109\n[  419.958867]  ? __pfx_hfsplus_fill_super+0x10/0x10\n[  419.959499]  ? __pfx_string+0x10/0x10\n[  419.960006]  ? lock_acquire+0x3e2/0x454\n[  419.960532]  ? bdev_name.constprop.0+0xce/0x243\n[  419.961129]  ? __pfx_bdev_name.constprop.0+0x10/0x10\n[  419.961799]  ? pointer+0x3f0/0x62f\n[  419.962277]  ? __pfx_pointer+0x10/0x10\n[  419.962761]  ? vsnprintf+0x6c4/0xfba\n[  419.963178]  ? __pfx_vsnprintf+0x10/0x10\n[  419.963621]  ? setup_bdev_super+0x376/0x3b3\n[  419.964029]  ? snprintf+0x9d/0xd2\n[  419.964344]  ? __pfx_snprintf+0x10/0x10\n[  419.964675]  ? lock_acquired+0x45c/0x5e9\n[  419.965016]  ? set_blocksize+0x139/0x1c1\n[  419.965381]  ? sb_set_blocksize+0x6d/0xae\n[  419.965742]  ? __pfx_hfsplus_fill_super+0x10/0x10\n[  419.966179]  mount_bdev+0x12f/0x1bf\n[  419.966512]  ? __pfx_mount_bdev+0x10/0x10\n[  419.966886]  ? vfs_parse_fs_string+0xce/0x111\n[  419.967293]  ? __pfx_vfs_parse_fs_string+0x10/0x10\n[  419.967702]  ? __pfx_hfsplus_mount+0x10/0x10\n[  419.968073]  legacy_get_tree+0x104/0x178\n[  419.968414]  vfs_get_tree+0x86/0x296\n[  419.968751]  path_mount+0xba3/0xd0b\n[  419.969157]  ? __pfx_path_mount+0x10/0x10\n[  419.969594]  ? kmem_cache_free+0x1e2/0x260\n[  419.970311]  do_mount+0x99/0xe0\n[  419.970630]  ? __pfx_do_mount+0x10/0x10\n[  419.971008]  __do_sys_mount+0x199/0x1c9\n[  419.971397]  do_syscall_64+0xd0/0x135\n[  419.971761]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[  419.972233] RIP: 0033:0x7c3cb812972e\n[  419.972564] Code: 48 8b 0d f5 46 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c2 46 0d 00 f7 d8 64 89 01 48\n[  419.974371] RSP: 002b:00007ffe30632548 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5\n[  419.975048] RAX: ffffffffffffffda RBX: 00007ffe306328d8 RCX: 00007c3cb812972e\n[  419.975701] RDX: 0000000020000000 RSI: 0000000020000c80 RDI:\n---truncated---"}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"6596528e391ad978a6a120142cba97a1d7324cb6","status":"affected","lessThan":"baccb5e12577b7a9eff54ffba301fdaa0f3ee5a8","versionType":"git"},{"version":"6596528e391ad978a6a120142cba97a1d7324cb6","status":"affected","lessThan":"f57725bcc5816425e25218fdf5fb6923bc578cdf","versionType":"git"},{"version":"6596528e391ad978a6a120142cba97a1d7324cb6","status":"affected","lessThan":"e8a2b1c1c2ea85e9a5a2d0c5a5a7e7c639feb866","versionType":"git"},{"version":"6596528e391ad978a6a120142cba97a1d7324cb6","status":"affected","lessThan":"06cbfbb13ac88f4154c2eb4bc4176f9d10139847","versionType":"git"},{"version":"6596528e391ad978a6a120142cba97a1d7324cb6","status":"affected","lessThan":"3d7bda75e1a6239db053c73acde17ca146317824","versionType":"git"},{"version":"6596528e391ad978a6a120142cba97a1d7324cb6","status":"affected","lessThan":"21900e8478126ff6afe3b66679f676e74d1f8830","versionType":"git"},{"version":"6596528e391ad978a6a120142cba97a1d7324cb6","status":"affected","lessThan":"2667c9b7b76efcbc7adbfea249892f20c313b0da","versionType":"git"},{"version":"6596528e391ad978a6a120142cba97a1d7324cb6","status":"affected","lessThan":"bfeecda050aa9376f642d5b2a71c4112cc6c8216","versionType":"git"},{"version":"6596528e391ad978a6a120142cba97a1d7324cb6","status":"affected","lessThan":"1c82587cb57687de3f18ab4b98a8850c789bedcf","versionType":"git"},{"version":"c53c89aba3ebdfc3e9acdb18bb5ee9d2f8a328d0","status":"affected","versionType":"git"},{"version":"3.0.8","status":"affected","lessThan":"3.1","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/hfsplus/hfsplus_fs.h","fs/hfsplus/wrapper.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.1","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.1","versionType":"semver"},{"version":"4.19.325","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.287","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.231","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.174","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.120","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.64","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.11.11","status":"unaffected","lessThanOrEqual":"6.11.*","versionType":"semver"},{"version":"6.12.2","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.13","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/hfsplus/hfsplus_fs.h","fs/hfsplus/wrapper.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/baccb5e12577b7a9eff54ffba301fdaa0f3ee5a8"},{"url":"https://git.kernel.org/stable/c/f57725bcc5816425e25218fdf5fb6923bc578cdf"},{"url":"https://git.kernel.org/stable/c/e8a2b1c1c2ea85e9a5a2d0c5a5a7e7c639feb866"},{"url":"https://git.kernel.org/stable/c/06cbfbb13ac88f4154c2eb4bc4176f9d10139847"},{"url":"https://git.kernel.org/stable/c/3d7bda75e1a6239db053c73acde17ca146317824"},{"url":"https://git.kernel.org/stable/c/21900e8478126ff6afe3b66679f676e74d1f8830"},{"url":"https://git.kernel.org/stable/c/2667c9b7b76efcbc7adbfea249892f20c313b0da"},{"url":"https://git.kernel.org/stable/c/bfeecda050aa9376f642d5b2a71c4112cc6c8216"},{"url":"https://git.kernel.org/stable/c/1c82587cb57687de3f18ab4b98a8850c789bedcf"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The attack requires local access to issue the `mount()` syscall on an hfsplus image and a concurrent `LOOP_SET_BLOCK_SIZE` ioctl on the backing loop device. There is no remote or adjacent-network path into `hfsplus_read_wrapper()`.\nAC:L - Although this is a race, the attacker controls both sides — they initiate the mount and drive the block-size ioctl from another thread — and can retry indefinitely; the window spans `hfsplus_get_last_session()`, two kmallocs and full bio round-trips through the `reread:` path, making it wide and reliably winnable.\nPR:L - `LOOP_SET_BLOCK_SIZE` needs only a writable loop fd with no CAP_SYS_ADMIN check, and the mount side is reachable by a low-privileged local user on the many deployments that delegate mounting (udisks2/autofs removable-media automount on desktops, Android/ChromeOS external HFS+ media, containers granted CAP_SYS_ADMIN), matching the CNA's established scoring for hfsplus mount-path flaws.\nUI:N - The attacker performs both the loop-device setup/ioctl and the mount themselves; no action by a separate victim user is needed.\nS:U - The heap corruption occurs in kernel memory and is exploited within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `*data = (u8 *)buf + offset` is computed with the enlarged io_size, so `sbi->s_vhdr`/`s_backup_vhdr` point outside the allocation and the code reads adjacent (including freed) slab memory, and the resulting slab corruption can be leveraged into a broader kernel-memory read primitive.\nI:H - The bio is built over up to PAGE_SIZE bytes starting at a 512-byte slab object, so the block read writes thousands of bytes of attacker-chosen loop backing-file content over neighbouring kmalloc objects — a controlled slab out-of-bounds write suitable for control-flow hijacking and privilege escalation.\nA:H - The out-of-bounds access reliably corrupts adjacent slab objects and triggers a KASAN slab-use-after-free/oops as shown in the commit log, readily causing a kernel panic."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T11:44:57.408Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.1","versionEndExcluding":"4.19.325"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.1","versionEndExcluding":"5.4.287"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.1","versionEndExcluding":"5.10.231"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.1","versionEndExcluding":"5.15.174"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.1","versionEndExcluding":"6.1.120"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.1","versionEndExcluding":"6.6.64"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.1","versionEndExcluding":"6.11.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.1","versionEndExcluding":"6.12.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.1","versionEndExcluding":"6.13"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0.8"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.8,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2024-56548","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2025-10-01T20:02:19.622310Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-787","lang":"en","type":"CWE","description":"CWE-787 Out-of-bounds Write"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-10-01T20:07:16.366Z"}},{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"},{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T20:49:23.519Z"}}]}}}