CVSS 5.5 · Medium EPSS 0,12%
Kerentanan Use of Uninitialized Resource pada linux kernel. Skor CVSS 3.1 5.5 (Medium) menurut NVD.
In the Linux kernel, the following vulnerability has been resolved: hfs/hfsplus: zero-initialize buffer in hfs_bnode_read hfs_bnode_read() can return early without writing to the output buffer when is_bnode_offset_valid() fails or when check_and_correct_requested_ length() corrects the length to zero. Callers such as hfs_bnode_read_ u16() and hfs_bnode_read_u8() pass stack-allocated buffers and use the result unconditionally, leading to KMSAN uninit-value reports. Rather than initializing at each individual call site, zero the buffer at the start of hfs_bnode_read() before any validation checks. This ensures all callers in both hfs and hfsplus get a deterministic zero value regardless of which early-return path is taken.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| linux | linux kernel | Versi 5.4.297 hingga sebelum 5.5 |
| linux | linux kernel | Versi 5.10.241 hingga sebelum 5.10.261 |
| linux | linux kernel | Versi 5.15.190 hingga sebelum 5.15.212 |
| linux | linux kernel | Versi 6.1.149 hingga sebelum 6.1.178 |
| linux | linux kernel | Versi 6.6.103 hingga sebelum 6.6.145 |
| linux | linux kernel | Versi 6.12.43 hingga sebelum 6.12.96 |
| linux | linux kernel | Versi 6.15.11 hingga sebelum 6.16 |
| linux | linux kernel | Versi 6.16.2 hingga sebelum 6.18.39 |
| linux | linux kernel | Versi 6.19 hingga sebelum 7.1.4 |