CVE-2024-27008
HighIn the Linux kernel, the following vulnerability has been resolved: drm: nv04: Fix out of bounds access When Output Resource (dcb->or) value is assigned in fabricate_dcb_output(), there may be out of bounds access to dac_users array in case dcb->or is zero because ffs(dcb->or) is used as index there. The 'or' argument of fabricate_dcb_output() must be interpreted as a number of bit to set, not value. Utilize macros from 'enum nouveau_or' in calls instead of hardcoding. Found by Linux Verification Center (linuxtesting.org) with SVACE.
CVSS 3.1 score
7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness type
CWE-125CVE-2024-27008 is a Out-of-bounds Read vulnerability
What is Out-of-bounds Read?
The product reads data past the end or before the beginning of the intended buffer. Learn more on MITRE CWE
References
The following references provide additional information about CVE-2024-27008 including vendor advisories, patch commits, exploit details, and third-party analysis. Links are sourced from the NIST NVD database.
-
Mailing List Third Party Advisory
-
Mailing List Third Party Advisory
-
Mailing List Third Party Advisory
-
Mailing List Third Party Advisory
-
Mailing List Third Party Advisory
-
PatchKernel patch commithttps://git.kernel.org/stable/c/097c7918fcfa1dee233acfd1f3029f00c3bc8062
-
PatchKernel patch commithttps://git.kernel.org/stable/c/26212da39ee14a52c76a202c6ae5153a84f579a5
-
PatchKernel patch commithttps://git.kernel.org/stable/c/5050ae879a828d752b439e3827aac126709da6d1
Frequently asked questions
-
What is CVE-2024-27008?
CVE-2024-27008 is a High severity Linux kernel vulnerability with a CVSS score of 7.8 out of 10 , classified as an Out-of-bounds Read flaw (CWE-125) . CVE-2024-27008 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
What is the CVSS score for CVE-2024-27008?
CVE-2024-27008 has a CVSS score of 7.8 out of 10, rated High severity (CVSS 3.1). The vector string is
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. -
Is there a patch available for CVE-2024-27008?
No patch is currently available for CVE-2024-27008. Monitor the NIST NVD and your Linux distribution's security advisories for updates.
-
Is CVE-2024-27008 actively exploited?
No — CVE-2024-27008 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
-
What is Out-of-bounds Read (CWE-125)?
The product reads data past the end or before the beginning of the intended buffer. View CWE-125 on MITRE CWE →