Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-43854— block: initialize integrity buffer to zero before writing it to media

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在写入媒体之前未能将完整性缓冲区初始化为零。

AI Predicted 7.8 Difficulty: Moderate EPSS 0.23% · P13

Possible ATT&CK Techniques 1 AI

T1005 · Data from Local System

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 7ba1ba12eeef0aa7113beb16410ef8b7c748e18b< 9f4af4cf08f9a0329ade3d938f55d2220c40d0a6 affected
7ba1ba12eeef0aa7113beb16410ef8b7c748e18b< 129f95948a96105c1fad8e612c9097763e88ac5f affected
7ba1ba12eeef0aa7113beb16410ef8b7c748e18b< 3fd11fe4f20756b4c0847f755a64cd96f8c6a005 affected
7ba1ba12eeef0aa7113beb16410ef8b7c748e18b< cf6b45ea7a8df0f61bded1dc4a8561ac6ad143d2 affected
7ba1ba12eeef0aa7113beb16410ef8b7c748e18b< d418313bd8f55c079a7da12651951b489a638ac1 affected
7ba1ba12eeef0aa7113beb16410ef8b7c748e18b< 23a19655fb56f241e592041156dfb1c6d04da644 affected
7ba1ba12eeef0aa7113beb16410ef8b7c748e18b< ebc0e91ba76dc6544fff9f5b66408b1982806a00 affected
7ba1ba12eeef0aa7113beb16410ef8b7c748e18b< 899ee2c3829c5ac14bfc7d3c4a5846c0b709b78f affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-43854

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
block: initialize integrity buffer to zero before writing it to media
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: block: initialize integrity buffer to zero before writing it to media Metadata added by bio_integrity_prep is using plain kmalloc, which leads to random kernel memory being written media. For PI metadata this is limited to the app tag that isn't used by kernel generated metadata, but for non-PI metadata the entire buffer leaks kernel memory. Fix this by adding the __GFP_ZERO flag to allocations for writes.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在写入媒体之前未能将完整性缓冲区初始化为零。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 7ba1ba12eeef0aa7113beb16410ef8b7c748e18b ~ 9f4af4cf08f9a0329ade3d938f55d2220c40d0a6 -
Linux Linux 2.6.27 -

II. Public POCs for CVE-2024-43854

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-43854

请登录查看更多情报信息。

Patches & Fixes for CVE-2024-43854 (1)

Other References for CVE-2024-43854 (5)

Same Patch Batch · Linux · 2024-08-17 · 109 CVEs total

CVE-2024-42285 9.8 CRITICAL RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
CVE-2024-42284 9.1 CRITICAL tipc: Return non-zero value from tipc_udp_addr2str() on error
CVE-2024-43848 8.8 HIGH wifi: mac80211: fix TTLM teardown work
CVE-2024-43847 8.8 HIGH wifi: ath12k: fix invalid memory access while processing fragmented packets
CVE-2024-42287 8.8 HIGH scsi: qla2xxx: Complete command early within lock
CVE-2024-42318 8.8 HIGH landlock: Don't lose track of restrictions on cred_transfer
CVE-2024-42301 7.8 HIGH dev/parport: fix the array out-of-bounds risk
CVE-2024-42280 7.8 HIGH mISDN: Fix a use after free in hfcmulti_tx()
CVE-2024-43846 7.8 HIGH lib: objagg: Fix general protection fault
CVE-2024-43845 7.8 HIGH udf: Fix bogus checksum computation in udf_rename()
CVE-2024-42288 7.8 HIGH scsi: qla2xxx: Fix for possible memory corruption
CVE-2024-43840 7.8 HIGH bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG
CVE-2024-42314 7.8 HIGH btrfs: fix extent map use-after-free when adding pages to compressed bio
CVE-2024-42297 7.8 HIGH f2fs: fix to don't dirty inode for readonly filesystem
CVE-2024-43830 7.8 HIGH leds: trigger: Unregister sysfs attributes before calling deactivate()
CVE-2024-42296 7.8 HIGH f2fs: fix return value of f2fs_convert_inline_inode()
CVE-2024-42299 7.8 HIGH fs/ntfs3: Update log->page_{mask,bits} if log->page_size changed
CVE-2024-42300 7.8 HIGH erofs: fix race in z_erofs_get_gbuf()
CVE-2024-42279 7.8 HIGH spi: microchip-core: ensure TX and RX FIFOs are empty at start of a transfer
CVE-2024-42293 7.8 HIGH arm64: mm: Fix lockless walks with static and dynamic page-table folding

Showing top 20 of 109 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2024-43854

No comments yet

Leave a comment