blktrace (aka Block IO Tracing) 1.2.0, as used with the Linux kernel and Android, has a buffer overflow in the dev_map_read function in btt/devmap.c because the device and devno arrays are too small, as demonstrated by an invalid free when using the btt program with a crafted file.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade blktrace-debuginfoUpgrade blktrace | Apr 27, 2020 | May 3, 2018 |
| Amazon_linux | — | Upgrade blktrace | Nov 23, 2019 | May 3, 2018 |
| Centos_linux | — | Upgrade blktraceUpgrade blktrace-debuginfo | Aug 28, 2019 | May 3, 2018 |
| Debian | — | Upgrade blktrace | Jul 30, 2024 | May 3, 2018 |
| Gentoo Linux | — | Upgrade sys-block/blktrace. | Jul 9, 2021 | May 3, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade blktrace | Sep 16, 2021 | May 3, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade blktrace | Apr 30, 2021 | May 3, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade blktrace | Feb 24, 2020 | May 3, 2018 |
| Oracle_linux | — | Upgrade blktrace | Jul 21, 2020 | May 2, 2018 |
| Redhat_linux | — | Upgrade blktraceNo solution existsUpgrade blktrace-debuginfo | Aug 7, 2019 | May 3, 2018 |
| Suse | — | Upgrade blktrace | Apr 18, 2019 | May 3, 2018 |
| Ubuntu | — | Upgrade blktrace | Nov 19, 2024 | May 3, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 3, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub