01 Record

CVE-2024-42306

udf: Avoid using corrupted block bitmap buffer

HighPUBLISHEDCNA: Linux

CNA base score7.8 CVSS v3.xCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

udf: Avoid using corrupted block bitmap buffer

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.25% probability of exploitation activity in the next 30 days.

EPSS percentile

Ranks above 15.6% of scored records. A rank, not a probability.

NVD base score

5.5 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-08-04.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2024-08-17 09:09Z2 YR AGO

Last updated

2026-08-05 11:36Z1 MO AGO

Reserved

2024-07-30

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 7.8)

CNA CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-20Improper Input ValidationClass

Data version

5.2

Document digest

f78573f033ae2afe1ba72cb0327ede79799f6e500dad7e53e2de5fe6f7add0e9

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux7648ea9896b31aff38830d81188f5b7a1773e4a8 to < cae9e59cc41683408b70b9ab569f8654866ba914, 4ac54312f623c6d2ca30c36c1ef530c11f5aff64 to < 2199e157a465aaf98294d3932797ecd7fce942d5, 099bf90d7fc4622da9fd4727f6d318a0f12d10be to < 6a43e3c210df6c5f00570f4be49a897677dbcb64, 6ac8f2c8362afd2baa8e7b9c946597589e587d22 to < 271cab2ca00652bc984e269cf1208699a1e09cdd, 1e0d4adf17e7ef03281d7b16555e7c1508c8ed2d to < 57053b3bcf3403b80db6f65aba284d7dfe7326af, 1e0d4adf17e7ef03281d7b16555e7c1508c8ed2d to < 8ca170c39eca7cad6e0cfeb24e351d8f8eddcd65, 1e0d4adf17e7ef03281d7b16555e7c1508c8ed2d to < a90d4471146de21745980cba51ce88e7926bcc4f, f862a9049c3f6e73a5504a1ac10ffd5bc253ab55, 4622cc1b6d86013e01c56b60b092b5e4726c8e52, 5.4.257 to < 5.4.282, 5.10.195 to < 5.10.224, 5.15.132 to < 5.15.165, 6.1.53 to < 6.1.103, 4.14.326 to < 4.15, 4.19.295 to < 4.20, 6.3—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/cae9e59cc41683408b70b9ab569f8654866ba914
git.kernel.orghttps://git.kernel.org/stable/c/2199e157a465aaf98294d3932797ecd7fce942d5
git.kernel.orghttps://git.kernel.org/stable/c/6a43e3c210df6c5f00570f4be49a897677dbcb64
git.kernel.orghttps://git.kernel.org/stable/c/271cab2ca00652bc984e269cf1208699a1e09cdd
git.kernel.orghttps://git.kernel.org/stable/c/57053b3bcf3403b80db6f65aba284d7dfe7326af
git.kernel.orghttps://git.kernel.org/stable/c/8ca170c39eca7cad6e0cfeb24e351d8f8eddcd65
git.kernel.orghttps://git.kernel.org/stable/c/a90d4471146de21745980cba51ce88e7926bcc4f
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2024/10/msg00003.html
cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-265688.html

01 Record index

CVE-2024-42306

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

02 Records

CVE-2024-42306

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References