Description
An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file. NOTE: this is unexploitable in GNU C Library environments, and possibly in all realistic environments.
CVSS breakdown
CVSS 3.1
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected products
References
- MISChttps://github.com/karelzak/util-linux/issues/1395
- PATCHhttps://github.com/karelzak/util-linux/commit/1c9143d0c1f979c3daf10e1c37b5b1e916c22a1c
- MISChttps://security.netapp.com/advisory/ntap-20210902-0002/
- MISChttps://security.gentoo.org/glsa/202401-08
- MAILING_LISThttps://lists.debian.org/debian-lts-announce/2024/04/msg00005.html
Updated 29m ago · 8 sources