CVSS 5.5 · Medium EPSS 0,89%
Kerentanan Improper Initialization pada linux kernel. Skor CVSS 3.1 5.5 (Medium) menurut NVD.
In the Linux kernel, the following vulnerability has been resolved: fuse: Initialize beyond-EOF page contents before setting uptodate fuse_notify_store(), unlike fuse_do_readpage(), does not enable page zeroing (because it can be used to change partial page contents). So fuse_notify_store() must be more careful to fully initialize page contents (including parts of the page that are beyond end-of-file) before marking the page uptodate. The current code can leave beyond-EOF page contents uninitialized, which makes these uninitialized page contents visible to userspace via mmap(). This is an information leak, but only affects systems which do not enable init-on-alloc (via CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y or the corresponding kernel command line parameter).
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| linux | linux kernel | Versi 2.6.36 hingga sebelum 4.19.321 |
| linux | linux kernel | Versi 4.20 hingga sebelum 5.4.283 |
| linux | linux kernel | Versi 5.5 hingga sebelum 5.10.225 |
| linux | linux kernel | Versi 5.11 hingga sebelum 5.15.166 |
| linux | linux kernel | Versi 5.16 hingga sebelum 6.1.107 |
| linux | linux kernel | Versi 6.2 hingga sebelum 6.6.48 |
| linux | linux kernel | Versi 6.7 hingga sebelum 6.10.7 |
| linux | linux kernel | Versi 6.11 rc1 |
| linux | linux kernel | Versi 6.11 rc2 |
| linux | linux kernel | Versi 6.11 rc3 |