CVE-2024-53106

ima: fix buffer overrun in ima_eventdigest_init_common

Description

In the Linux kernel, the following vulnerability has been resolved: ima: fix buffer overrun in ima_eventdigest_init_common Function ima_eventdigest_init() calls ima_eventdigest_init_common() with HASH_ALGO__LAST which is then used to access the array hash_digest_size[] leading to buffer overrun. Have a conditional statement to handle this.

N/A

CVSS

Severity:

EPSS 0.04%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/e01aae58e818503f2ffcd34c6f7dc6f90af1057e
https://git.kernel.org/stable/c/8a84765c62cc0469864e2faee43aae253ad16082
https://git.kernel.org/stable/c/1ecf0df5205cfb0907eb7984b8671257965a5232
https://git.kernel.org/stable/c/923168a0631bc42fffd55087b337b1b6c54dcff5

Frequently Asked Questions

What is the severity of CVE-2024-53106?: CVE-2024-53106 has not yet been assigned a CVSS score.
How to fix CVE-2024-53106?: To fix CVE-2024-53106, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-53106 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2024-53106 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-53106?: CVE-2024-53106 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.