CVE-2024-38585

tools/nolibc/stdlib: fix memory error in realloc()

Description

In the Linux kernel, the following vulnerability has been resolved: tools/nolibc/stdlib: fix memory error in realloc() Pass user_p_len to memcpy() instead of heap->len to prevent realloc() from copying an extra sizeof(heap) bytes from beyond the allocated region.

N/A

CVSS

Severity:

EPSS 0.10%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/5996b2b2dac739f2a27da13de8eee5b85b2550b3
https://git.kernel.org/stable/c/f678c3c336559cf3255a32153e9a17c1be4e7c15
https://git.kernel.org/stable/c/8019d3dd921f39a237a9fab6d2ce716bfac0f983
https://git.kernel.org/stable/c/4e6f225aefeb712cdb870176b6621f02cf235b8c
https://git.kernel.org/stable/c/791f4641142e2aced85de082e5783b4fb0b977c2

Frequently Asked Questions

What is the severity of CVE-2024-38585?: CVE-2024-38585 has not yet been assigned a CVSS score.
How to fix CVE-2024-38585?: To fix CVE-2024-38585, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-38585 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2024-38585 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-38585?: CVE-2024-38585 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.