In the Linux kernel, the following vulnerability has been resolved: nvme-pci: add missing condition check for existence of mapped data nvme_map_data() is called when request has physical segments, hence the nvme_unmap_data() should have same condition to avoid dereference.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Redhat
  • Enterprise Linux

No data.

Package CPE Advisory Released Date
Red Hat Enterprise Linux 9
kernel-0:5.14.0-503.11.1.el9_5 cpe:/a:redhat:enterprise_linux:9 RHSA-2024:9315 2024-11-12T00:00:00Z
kernel-0:5.14.0-503.11.1.el9_5 cpe:/o:redhat:enterprise_linux:9 RHSA-2024:9315 2024-11-12T00:00:00Z
References
Link Providers
https://git.kernel.org/stable/c/3f8ec1d6b0ebd8268307d52be8301973fa5a01ec cve-icon cve-icon
https://git.kernel.org/stable/c/70100fe721840bf6d8e5abd25b8bffe4d2e049b7 cve-icon cve-icon
https://git.kernel.org/stable/c/77848b379e9f85a08048a2c8b3b4a7e8396f5f83 cve-icon cve-icon
https://git.kernel.org/stable/c/7cc1f4cd90a00b6191cb8cda2d1302fdce59361c cve-icon cve-icon
https://git.kernel.org/stable/c/be23ae63080e0bf9e246ab20207200bca6585eba cve-icon cve-icon
https://git.kernel.org/stable/c/c31fad1470389666ac7169fe43aa65bf5b7e2cfd cve-icon cve-icon
https://git.kernel.org/stable/c/d135c3352f7c947a922da93c8e763ee6bc208b64 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2024081741-CVE-2024-42276-cb0a@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2024-42276 cve-icon
https://www.cve.org/CVERecord?id=CVE-2024-42276 cve-icon
History

Wed, 13 Nov 2024 02:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat enterprise Linux
CPEs cpe:/a:redhat:enterprise_linux:9
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux

Wed, 11 Sep 2024 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 06 Sep 2024 13:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-476
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}

Mon, 19 Aug 2024 19:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Mon, 19 Aug 2024 04:45:00 +0000

Type Values Removed Values Added
References

Sat, 17 Aug 2024 09:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: nvme-pci: add missing condition check for existence of mapped data nvme_map_data() is called when request has physical segments, hence the nvme_unmap_data() should have same condition to avoid dereference.
Title nvme-pci: add missing condition check for existence of mapped data
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-08-17T09:08:44.694Z

Updated: 2024-11-05T09:39:33.324Z

Reserved: 2024-07-30T07:40:12.261Z

Link: CVE-2024-42276

cve-icon Vulnrichment

Updated: 2024-09-11T12:42:23.844Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2024-08-17T09:15:08.673

Modified: 2024-08-19T12:59:59.177

Link: CVE-2024-42276

cve-icon Redhat

Severity : Moderate

Publid Date: 2024-08-17T00:00:00Z

Links: CVE-2024-42276 - Bugzilla