01 Record

CVE-2024-56548

hfsplus: don't query the device logical block size multiple times

HighPUBLISHEDCNA: Linux

CNA base score7.8 CVSS v3.xCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

hfsplus: don't query the device logical block size multiple times

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.24% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 15.8% of scored records. A rank, not a probability.

NVD base score

7.8 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-06-17.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2024-12-27 14:11Z1 YR AGO

Last updated

2026-08-05 11:44Z2 MO AGO

Reserved

2024-12-27

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 7.8)

CNA CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-787Out-of-bounds WriteBase

Data version

5.2

Document digest

9bafda92ec22312e5646a28049f984f7317356d32149e399c4fe25f7cd473ce2

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux6596528e391ad978a6a120142cba97a1d7324cb6 to < baccb5e12577b7a9eff54ffba301fdaa0f3ee5a8, 6596528e391ad978a6a120142cba97a1d7324cb6 to < f57725bcc5816425e25218fdf5fb6923bc578cdf, 6596528e391ad978a6a120142cba97a1d7324cb6 to < e8a2b1c1c2ea85e9a5a2d0c5a5a7e7c639feb866, 6596528e391ad978a6a120142cba97a1d7324cb6 to < 06cbfbb13ac88f4154c2eb4bc4176f9d10139847, 6596528e391ad978a6a120142cba97a1d7324cb6 to < 3d7bda75e1a6239db053c73acde17ca146317824, 6596528e391ad978a6a120142cba97a1d7324cb6 to < 21900e8478126ff6afe3b66679f676e74d1f8830, 6596528e391ad978a6a120142cba97a1d7324cb6 to < 2667c9b7b76efcbc7adbfea249892f20c313b0da, 6596528e391ad978a6a120142cba97a1d7324cb6 to < bfeecda050aa9376f642d5b2a71c4112cc6c8216, 6596528e391ad978a6a120142cba97a1d7324cb6 to < 1c82587cb57687de3f18ab4b98a8850c789bedcf, c53c89aba3ebdfc3e9acdb18bb5ee9d2f8a328d0, 3.0.8 to < 3.1, 3.1—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/baccb5e12577b7a9eff54ffba301fdaa0f3ee5a8
git.kernel.orghttps://git.kernel.org/stable/c/f57725bcc5816425e25218fdf5fb6923bc578cdf
git.kernel.orghttps://git.kernel.org/stable/c/e8a2b1c1c2ea85e9a5a2d0c5a5a7e7c639feb866
git.kernel.orghttps://git.kernel.org/stable/c/06cbfbb13ac88f4154c2eb4bc4176f9d10139847
git.kernel.orghttps://git.kernel.org/stable/c/3d7bda75e1a6239db053c73acde17ca146317824
git.kernel.orghttps://git.kernel.org/stable/c/21900e8478126ff6afe3b66679f676e74d1f8830
git.kernel.orghttps://git.kernel.org/stable/c/2667c9b7b76efcbc7adbfea249892f20c313b0da
git.kernel.orghttps://git.kernel.org/stable/c/bfeecda050aa9376f642d5b2a71c4112cc6c8216
git.kernel.orghttps://git.kernel.org/stable/c/1c82587cb57687de3f18ab4b98a8850c789bedcf
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2025/03/msg00001.html
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2025/03/msg00002.html

07 Fixed in

Debian 12

linux
Fixed in 6.1.123-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.3-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 6.12.3-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.