Linux Kernel Heap-Based Buffer Overflow Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 21/08/2024. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| Kernel | Versions not published yet (product named by CISA KEV) | |
A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling) could use this flaw to escalate their privileges on the system.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free