CVE-2024-43845
Description
From CVE.org
In the Linux kernel, the following vulnerability has been resolved: udf: Fix bogus checksum computation in udf_rename() Syzbot reports uninitialized memory access in udf_rename() when updating checksum of '..' directory entry of a moved directory. This is indeed true as we pass on-stack diriter.fi to the udf_update_tag() and because that has only struct fileIdentDesc included in it and not the impUse or name fields, the checksumming function is going to checksum random stack contents beyond the end of the structure. This is actually harmless because the following udf_fiiter_write_fi() will recompute the checksum from on-disk buffers where everything is properly included. So all that is needed is just removing the bogus calculation.
Statement
A flaw of low impact was found in the Linux kernel's UDF file system implementation. When renaming a directory on a UDF file system, udf_rename() passed an on-stack file identifier structure that contains only the fileIdentDesc fields and not the impUse or name fields to the tag checksum computation, so the checksumming function read uninitialized stack memory beyond the end of the structure while updating the checksum of the '..' directory entry of a moved directory. The incorrectly computed checksum is never persisted: the subsequent write of the file identifier recomputes the checksum from the on-disk buffers that contain the complete directory entry, so the miscalculation has no lasting effect, and the upstream fix simply removes the bogus calculation. For this reason Red Hat rates the issue as Low severity (CVSS 3.3), which differs meaningfully from the higher score in the CVE.org record, as that score does not account for the checksum being recomputed before anything is written. The issue was introduced in upstream kernel version 6.3, and Red Hat Enterprise Linux 8 and 9 ship kernels based on earlier versions, so they are not affected. The affected Red Hat offering is Fedora, which tracks the upstream community kernel, and a fix is being pursued for it through the normal Fedora kernel updates.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.3 | 3.3 | 7.8 |
| Attack Vector | Local | Local | Local |
| Attack Complexity | Low | Low | Low |
| Privileges Required | Low | Low | Low |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | None | None | High |
| Integrity Impact | None | Low | High |
| Availability Impact | Low | None | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
