Huawei EulerOS: CVE-2024-26828: kernel security update

Huawei EulerOS: CVE-2024-26828: kernel security update

Severity

4

CVSS

(AV:L/AC:M/Au:N/C:P/I:P/A:P)

Published

04/17/2024

Created

07/23/2024

Added

07/23/2024

Modified

10/08/2024

Description

In the Linux kernel, the following vulnerability has been resolved: cifs: fix underflow in parse_server_interfaces() In this loop, we step through the buffer and after each item we check if the size_left is greater than the minimum size we need.However, the problem is that "bytes_left" is type ssize_t while sizeof() is type size_t.That means that because of type promotion, the comparison is done as an unsigned and if we have negative bytes left the loop continues instead of ending.

Solution(s)

• huawei-euleros-2_0_sp8-upgrade-bpftool
• huawei-euleros-2_0_sp8-upgrade-kernel
• huawei-euleros-2_0_sp8-upgrade-kernel-devel
• huawei-euleros-2_0_sp8-upgrade-kernel-headers
• huawei-euleros-2_0_sp8-upgrade-kernel-tools
• huawei-euleros-2_0_sp8-upgrade-kernel-tools-libs
• huawei-euleros-2_0_sp8-upgrade-perf
• huawei-euleros-2_0_sp8-upgrade-python-perf
• huawei-euleros-2_0_sp8-upgrade-python3-perf

References

• https://attackerkb.com/topics/cve-2024-26828
• CVE - 2024-26828
• EulerOS-SA-2024-2476