CVE-2024-47682

scsi: sd: Fix off-by-one error in sd_read_block_characteristics()

HIGH

7.8

CVSS Score

Published: October 21, 2024 at 11:53 AM UTC

Updated: August 5, 2026 at 12:04 PM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.5%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix off-by-one error in sd_read_block_characteristics() Ff the device returns page 0xb1 with length 8 (happens with qemu v2.x, for example), sd_read_block_characteristics() may attempt an out-of-bounds memory access when accessing the zoned field at offset 8.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

5.19 ≤ v < 6.1.1135.19 ≤ v < 6.10.135.19 ≤ v < 6.11.25.19 ≤ v < 6.125.19 ≤ v < 6.6.546.11 ≤ v < 6.11.26.2 ≤ v < 6.6.546.7 ≤ v < 6.10.135.197fb019c46eeea4e3cc3ddfd3e01a24e610f34fac

Vendor states this is fixed in 413df704f149dec585df07466d2401bbd1f490a0 (fixed)

Vendor states this is fixed in 568c7c4c77eee6df7677bb861b7cee7398a3255d (fixed)

Vendor states this is fixed in 60312ae7392f9c75c6591a52fc359cf7f810d48f (fixed)

Vendor states this is fixed in a776050373893e4c847a49abeae2ccb581153df0 (fixed)

Vendor states this is fixed in f81eaf08385ddd474a2f41595a7757502870c0eb (fixed)

Vendor states this is fixed in 5.19 (unaffected)

Vendor states this is fixed in 6.1.113 (unaffected)

Vendor states this is fixed in 6.10.13 (unaffected)

Vendor states this is fixed in 6.11.2 (unaffected)

Vendor states this is fixed in 6.12 (unaffected)

Vendor states this is fixed in 6.6.54 (unaffected)