In the Linux kernel, the following vulnerability has been resolved:
isdn: cpai: check ctr->cnr to avoid array index out of bound
The cmtp_add_connection() would add a cmtp session to a controller and run a kernel thread to process cmtp.
__module_get(THIS_MODULE); session->task = kthread_run(cmtp_session, session, "kcmtpd_ctr_%d", session->num);
During this process, the kernel thread would call detach_capi_ctr() to detach a register controller. if the controller was not attached yet, detach_capi_ctr() would trigger an array-index-out-bounds bug.
[ 46.866069][ T6479] UBSAN: array-index-out-of-bounds in drivers/isdn/capi/kcapi.c:483:21 [ 46.867196][ T6479] index -1 is out of range for type 'capi_ctr *[32]' [ 46.867982][ T6479] CPU: 1 PID: 6479 Comm: kcmtpd_ctr_0 Not tainted 5.15.0-rc2+ #8 [ 46.869002][ T6479] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 [ 46.870107][ T6479] Call Trace: [ 46.870473][ T6479] dump_stack_lvl+0x57/0x7d [ 46.870974][ T6479] ubsan_epilogue+0x5/0x40 [ 46.871458][ T6479] __ubsan_handle_out_of_bounds.cold+0x43/0x48 [ 46.872135][ T6479] detach_capi_ctr+0x64/0xc0 [ 46.872639][ T6479] cmtp_session+0x5c8/0x5d0 [ 46.873131][ T6479] ? __init_waitqueue_head+0x60/0x60 [ 46.873712][ T6479] ? cmtp_add_msgpart+0x120/0x120 [ 46.874256][ T6479] kthread+0x147/0x170 [ 46.874709][ T6479] ? set_kthread_struct+0x40/0x40 [ 46.875248][ T6479] ret_from_fork+0x1f/0x30 [ 46.875773][ T6479]
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Jun 20, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 20, 2024 |
| Suse | — | Upgrade kernel-docsUpgrade dlm-kmp-rtUpgrade kernel-default-baseUpgrade kernel-azure-optionalUpgrade kernel-rt_debug-livepatch-develUpgrade reiserfs-kmp-rtUpgrade gfs2-kmp-azureUpgrade kernel-rt_debug-develUpgrade kernel-defaultUpgrade kernel-rt_debugUpgrade kernel-devel-rtUpgrade cluster-md-kmp-rtUpgrade ocfs2-kmp-azureUpgrade kernel-default-develUpgrade kernel-rt-develUpgrade kernel-preempt-develUpgrade kernel-64kb-develUpgrade kernel-azureUpgrade kselftests-kmp-rtUpgrade kernel-symsUpgrade reiserfs-kmp-defaultUpgrade kernel-azure-extraUpgrade kernel-develUpgrade kernel-rt-livepatchUpgrade gfs2-kmp-rtUpgrade kernel-azure-vdsoUpgrade dlm-kmp-azureUpgrade kernel-zfcpdumpUpgrade kernel-source-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-source-azureUpgrade kernel-azure-baseUpgrade kernel-sourceUpgrade kernel-syms-rtUpgrade kernel-rt-vdsoUpgrade kernel-rtUpgrade kernel-64kbUpgrade kernel-syms-azureUpgrade kernel-obs-buildUpgrade kernel-rt-optionalUpgrade kernel-rt-extraUpgrade kernel-default-extraUpgrade cluster-md-kmp-azureUpgrade ocfs2-kmp-rtUpgrade kernel-rt-livepatch-develUpgrade kernel-azure-develUpgrade kernel-azure-livepatch-develUpgrade kernel-preemptUpgrade kernel-default-manUpgrade kernel-devel-azureUpgrade reiserfs-kmp-azureUpgrade kernel-macrosUpgrade kselftests-kmp-azure | Aug 9, 2024 | Jun 20, 2024 |
| Ubuntu | — | Upgrade linux-gcpUpgrade linux-azure-5.4Upgrade linux-azure-4.15Upgrade linux-raspiUpgrade linux-azureUpgrade linux-awsUpgrade linux-aws-5.4Upgrade linux-oracle-5.4Upgrade linux-kvmUpgrade linux-raspi-5.4Upgrade linux-bluefieldUpgrade linux-fipsUpgrade linux-gcp-5.4Upgrade linux-lts-xenialUpgrade linux-ibmUpgrade linux-azure-fde-5.15Upgrade linux-aws-fipsUpgrade linuxUpgrade linux-hwe-5.4Upgrade linux-oracleUpgrade linux-azure-fipsUpgrade linux-gcp-4.15Upgrade linux-gcp-fipsUpgrade linux-aws-hweUpgrade linux-gkeopUpgrade linux-hwe | Nov 19, 2024 | Jun 20, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub