GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-53151 (GCVE-0-2024-53151)

Vulnerability from cvelistv5 – Published: 2024-12-24 11:28 – Updated: 2026-08-05 11:44
VLAI
Title
svcrdma: Address an integer overflow
Summary
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Address an integer overflow Dan Carpenter reports: > Commit 78147ca8b4a9 ("svcrdma: Add a "parsed chunk list" data > structure") from Jun 22, 2020 (linux-next), leads to the following > Smatch static checker warning: > > net/sunrpc/xprtrdma/svc_rdma_recvfrom.c:498 xdr_check_write_chunk() > warn: potential user controlled sizeof overflow 'segcount * 4 * 4' > > net/sunrpc/xprtrdma/svc_rdma_recvfrom.c > 488 static bool xdr_check_write_chunk(struct svc_rdma_recv_ctxt *rctxt) > 489 { > 490 u32 segcount; > 491 __be32 *p; > 492 > 493 if (xdr_stream_decode_u32(&rctxt->rc_stream, &segcount)) > ^^^^^^^^ > > 494 return false; > 495 > 496 /* A bogus segcount causes this buffer overflow check to fail. */ > 497 p = xdr_inline_decode(&rctxt->rc_stream, > --> 498 segcount * rpcrdma_segment_maxsz * sizeof(*p)); > > > segcount is an untrusted u32. On 32bit systems anything >= SIZE_MAX / 16 will > have an integer overflow and some those values will be accepted by > xdr_inline_decode().
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 20:09 UTC
CWE
  • CWE-190 - Integer Overflow or Wraparound
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 78147ca8b4a9b6cf0e597ddd6bf17959e08376c2 , < 21e1cf688fb0397788c8dd42e1e0b08d58ac5c7b (git)
Affected: 78147ca8b4a9b6cf0e597ddd6bf17959e08376c2 , < c1f8195bf68edd2cef0f18a4cead394075a54b5a (git)
Affected: 78147ca8b4a9b6cf0e597ddd6bf17959e08376c2 , < 838dd342962cef4c320632a5af48d3c31f2f9877 (git)
Affected: 78147ca8b4a9b6cf0e597ddd6bf17959e08376c2 , < 4cbc3ba6dc2f746497cade60bcbaa82ae3696689 (git)
Affected: 78147ca8b4a9b6cf0e597ddd6bf17959e08376c2 , < e5c440c227ecdc721f2da0dd88b6358afd1031a7 (git)
Affected: 78147ca8b4a9b6cf0e597ddd6bf17959e08376c2 , < 3c63d8946e578663b868cb9912dac616ea68bfd0 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.11
Unaffected: 0 , < 5.11 (semver)
Unaffected: 5.15.174 , ≤ 5.15.* (semver)
Unaffected: 6.1.120 , ≤ 6.1.* (semver)
Unaffected: 6.6.64 , ≤ 6.6.* (semver)
Unaffected: 6.11.11 , ≤ 6.11.* (semver)
Unaffected: 6.12.2 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-53151",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T20:09:46.736232Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-190",
                "description": "CWE-190 Integer Overflow or Wraparound",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:17:09.093Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:46:36.897Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xprtrdma/svc_rdma_recvfrom.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "21e1cf688fb0397788c8dd42e1e0b08d58ac5c7b",
              "status": "affected",
              "version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
              "versionType": "git"
            },
            {
              "lessThan": "c1f8195bf68edd2cef0f18a4cead394075a54b5a",
              "status": "affected",
              "version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
              "versionType": "git"
            },
            {
              "lessThan": "838dd342962cef4c320632a5af48d3c31f2f9877",
              "status": "affected",
              "version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
              "versionType": "git"
            },
            {
              "lessThan": "4cbc3ba6dc2f746497cade60bcbaa82ae3696689",
              "status": "affected",
              "version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
              "versionType": "git"
            },
            {
              "lessThan": "e5c440c227ecdc721f2da0dd88b6358afd1031a7",
              "status": "affected",
              "version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
              "versionType": "git"
            },
            {
              "lessThan": "3c63d8946e578663b868cb9912dac616ea68bfd0",
              "status": "affected",
              "version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xprtrdma/svc_rdma_recvfrom.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.174",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.174",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.120",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.64",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.11",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.2",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Address an integer overflow\n\nDan Carpenter reports:\n\u003e Commit 78147ca8b4a9 (\"svcrdma: Add a \"parsed chunk list\" data\n\u003e structure\") from Jun 22, 2020 (linux-next), leads to the following\n\u003e Smatch static checker warning:\n\u003e\n\u003e\tnet/sunrpc/xprtrdma/svc_rdma_recvfrom.c:498 xdr_check_write_chunk()\n\u003e\twarn: potential user controlled sizeof overflow \u0027segcount * 4 * 4\u0027\n\u003e\n\u003e net/sunrpc/xprtrdma/svc_rdma_recvfrom.c\n\u003e     488 static bool xdr_check_write_chunk(struct svc_rdma_recv_ctxt *rctxt)\n\u003e     489 {\n\u003e     490         u32 segcount;\n\u003e     491         __be32 *p;\n\u003e     492\n\u003e     493         if (xdr_stream_decode_u32(\u0026rctxt-\u003erc_stream, \u0026segcount))\n\u003e                                                               ^^^^^^^^\n\u003e\n\u003e     494                 return false;\n\u003e     495\n\u003e     496         /* A bogus segcount causes this buffer overflow check to fail. */\n\u003e     497         p = xdr_inline_decode(\u0026rctxt-\u003erc_stream,\n\u003e --\u003e 498                               segcount * rpcrdma_segment_maxsz * sizeof(*p));\n\u003e\n\u003e\n\u003e segcount is an untrusted u32.  On 32bit systems anything \u003e= SIZE_MAX / 16 will\n\u003e have an integer overflow and some those values will be accepted by\n\u003e xdr_inline_decode()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The flaw is in nfsd\u0027s RPC-over-RDMA server transport header parser, driven entirely by bytes a remote peer places in a Send to the NFS/RDMA listener (port 20049). RoCEv2 and iWARP are IP-routable, and soft-RoCE/soft-iWARP make this reachable over ordinary Ethernet, so this is a remote network attack surface.\nAC:L - The attacker simply encodes segcount=0x40000000 in a Write chunk or Reply chunk; the 32-bit truncation and the xdr_inline_decode(0) short-circuit are deterministic with no race, no memory-layout dependency, and no timing element. Verified the truncation occurs on 64-bit as well as 32-bit hosts.\nPR:N - svc_rdma_xdr_decode_req() runs in svc_rdma_recvfrom() at the transport layer, strictly before svc_process()/svc_authenticate() and before any export or credential check. Any peer able to establish an RDMA-CM connection reaches it with zero credentials.\nUI:N - The malformed transport header is processed automatically by the nfsd receive path as soon as it arrives. No action by any local user or administrator is required.\nS:U - The bad computation and its consequences are confined to the kernel\u0027s own memory management within the same security authority. There is no VM, IOMMU, or sandbox boundary crossed.\nC:N - I traced every consumer of the bogus segcount: the only use is pcl_alloc_chunk(), whose oversized kmalloc fails before pcl_alloc_write() can dereference its unchecked raw pointer, so no out-of-bounds data is read. The failed decode returns only a generic RDMA_ERROR reply, disclosing nothing.\nI:N - The bounds-check bypass never reaches the unbounded ch_segments[] write loop in pcl_alloc_write(), because chunk allocation aborts first and the request is rejected with -EINVAL. No kernel memory is modified and no attacker-controlled data is written out of bounds.\nA:H - The bypassed check drives a multi-gigabyte kmalloc whose order exceeds MAX_PAGE_ORDER, tripping WARN_ON_ONCE_GFP() in __alloc_pages() with a stack trace and kernel taint; on the widely deployed panic_on_warn=1 configurations this is an immediate kernel panic triggered by an unauthenticated remote peer."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:44:11.228Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/21e1cf688fb0397788c8dd42e1e0b08d58ac5c7b"
        },
        {
          "url": "https://git.kernel.org/stable/c/c1f8195bf68edd2cef0f18a4cead394075a54b5a"
        },
        {
          "url": "https://git.kernel.org/stable/c/838dd342962cef4c320632a5af48d3c31f2f9877"
        },
        {
          "url": "https://git.kernel.org/stable/c/4cbc3ba6dc2f746497cade60bcbaa82ae3696689"
        },
        {
          "url": "https://git.kernel.org/stable/c/e5c440c227ecdc721f2da0dd88b6358afd1031a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c63d8946e578663b868cb9912dac616ea68bfd0"
        }
      ],
      "title": "svcrdma: Address an integer overflow",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-53151",
    "datePublished": "2024-12-24T11:28:50.917Z",
    "dateReserved": "2024-11-19T17:17:25.000Z",
    "dateUpdated": "2026-08-05T11:44:11.228Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-53151",
      "date": "2026-09-18",
      "epss": "0.00636",
      "percentile": "0.49025"
    },
    "microsoft_vex": {
      "current_release_date": "2025-03-08T00:00:00.000Z",
      "cve": "CVE-2024-53151",
      "id": "msrc_CVE-2024-53151",
      "initial_release_date": "2024-12-02T00:00:00.000Z",
      "product_status:fixed": "4",
      "product_status:known_affected": "4",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "svcrdma: Address an integer overflow",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-53151.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/sunrpc/xprtrdma/svc_rdma_recvfrom.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "21e1cf688fb0397788c8dd42e1e0b08d58ac5c7b",
                    "status": "affected",
                    "version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c1f8195bf68edd2cef0f18a4cead394075a54b5a",
                    "status": "affected",
                    "version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "838dd342962cef4c320632a5af48d3c31f2f9877",
                    "status": "affected",
                    "version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4cbc3ba6dc2f746497cade60bcbaa82ae3696689",
                    "status": "affected",
                    "version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e5c440c227ecdc721f2da0dd88b6358afd1031a7",
                    "status": "affected",
                    "version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3c63d8946e578663b868cb9912dac616ea68bfd0",
                    "status": "affected",
                    "version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/sunrpc/xprtrdma/svc_rdma_recvfrom.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.11"
                  },
                  {
                    "lessThan": "5.11",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.174",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.120",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.64",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.11.*",
                    "status": "unaffected",
                    "version": "6.11.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.13",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "419FD073-1517-4FD5-8158-F94BC68A1E89",
                    "versionEndExcluding": "5.15.174",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "09AC6122-E2A4-40FE-9D33-268A1B2EC265",
                    "versionEndExcluding": "6.1.120",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CA16DEE3-ABEC-4449-9F4A-7A3DC4FC36C7",
                    "versionEndExcluding": "6.6.64",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "21434379-192D-472F-9B54-D45E3650E893",
                    "versionEndExcluding": "6.11.11",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D8882B1B-2ABC-4838-AC1D-DBDBB5764776",
                    "versionEndExcluding": "6.12.2",
                    "versionStartIncluding": "6.12",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Address an integer overflow\n\nDan Carpenter reports:\n\u003e Commit 78147ca8b4a9 (\"svcrdma: Add a \"parsed chunk list\" data\n\u003e structure\") from Jun 22, 2020 (linux-next), leads to the following\n\u003e Smatch static checker warning:\n\u003e\n\u003e\tnet/sunrpc/xprtrdma/svc_rdma_recvfrom.c:498 xdr_check_write_chunk()\n\u003e\twarn: potential user controlled sizeof overflow \u0027segcount * 4 * 4\u0027\n\u003e\n\u003e net/sunrpc/xprtrdma/svc_rdma_recvfrom.c\n\u003e     488 static bool xdr_check_write_chunk(struct svc_rdma_recv_ctxt *rctxt)\n\u003e     489 {\n\u003e     490         u32 segcount;\n\u003e     491         __be32 *p;\n\u003e     492\n\u003e     493         if (xdr_stream_decode_u32(\u0026rctxt-\u003erc_stream, \u0026segcount))\n\u003e                                                               ^^^^^^^^\n\u003e\n\u003e     494                 return false;\n\u003e     495\n\u003e     496         /* A bogus segcount causes this buffer overflow check to fail. */\n\u003e     497         p = xdr_inline_decode(\u0026rctxt-\u003erc_stream,\n\u003e --\u003e 498                               segcount * rpcrdma_segment_maxsz * sizeof(*p));\n\u003e\n\u003e\n\u003e segcount is an untrusted u32.  On 32bit systems anything \u003e= SIZE_MAX / 16 will\n\u003e have an integer overflow and some those values will be accepted by\n\u003e xdr_inline_decode()."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: svcrdma: soluciona un desbordamiento de enteros Dan Carpenter informa: \u0026gt; Commit 78147ca8b4a9 (\"svcrdma: agrega una estructura de datos de lista de fragmentos analizados\") del 22 de junio de 2020 (linux-next ), conduce a la siguiente \u0026gt; Advertencia del comprobador est\u00e1tico Smatch: \u0026gt; \u0026gt; net/sunrpc/xprtrdma/svc_rdma_recvfrom.c:498 xdr_check_write_chunk() \u0026gt; advertencia: tama\u00f1o de desbordamiento potencial controlado por el usuario \u0027segcount * 4 * 4\u0027 \u0026gt; \u0026gt; net/sunrpc/xprtrdma/svc_rdma_recvfrom.c \u0026gt; 488 static bool xdr_check_write_chunk(struct svc_rdma_recv_ctxt *rctxt) \u0026gt; 489 { \u0026gt; 490 u32 segcount; \u0026gt; 491 __be32 *p; \u0026gt; 492 \u0026gt; 493 if (xdr_stream_decode_u32(\u0026amp;rctxt-\u0026gt;rc_stream, \u0026amp;segcount)) \u0026gt; ^^^^^^^^ \u0026gt; \u0026gt; 494 devuelve falso; \u0026gt; 495 \u0026gt; 496 /* Un recuento de segmentos falso provoca que esta comprobaci\u00f3n de desbordamiento del b\u00fafer falle. */\u0026gt; 497 p = xdr_inline_decode(\u0026amp;rctxt-\u0026gt;rc_stream, \u0026gt; --\u0026gt; 498 segcount * rpcrdma_segment_maxsz * sizeof(*p)); \u0026gt; \u0026gt; \u0026gt; segcount es un u32 que no es de confianza. En sistemas de 32 bits, cualquier cosa \u0026gt;= TAMA\u00d1O_MAX / 16 tendr\u00e1 \u0026gt; un desbordamiento de enteros y algunos de esos valores ser\u00e1n aceptados por \u0026gt; xdr_inline_decode()."
          }
        ],
        "id": "CVE-2024-53151",
        "lastModified": "2026-08-04T11:21:59.097",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-53151",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T20:09:46.736232Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-12-24T12:15:23.240",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/21e1cf688fb0397788c8dd42e1e0b08d58ac5c7b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3c63d8946e578663b868cb9912dac616ea68bfd0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4cbc3ba6dc2f746497cade60bcbaa82ae3696689"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/838dd342962cef4c320632a5af48d3c31f2f9877"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c1f8195bf68edd2cef0f18a4cead394075a54b5a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e5c440c227ecdc721f2da0dd88b6358afd1031a7"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-190"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-190"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:40:34+00:00",
      "cve": "CVE-2024-53151",
      "id": "CVE-2024-53151",
      "initial_release_date": "2024-12-24T00:00:00+00:00",
      "product_status:known_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: svcrdma: Address an integer overflow",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-53151.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "HIGH",
                  "baseScore": 5.5,
                  "baseSeverity": "MEDIUM",
                  "confidentialityImpact": "NONE",
                  "integrityImpact": "NONE",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-53151",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-10-01T20:09:46.736232Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-190",
                    "description": "CWE-190 Integer Overflow or Wraparound",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-10-01T15:35:36.718Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "net/sunrpc/xprtrdma/svc_rdma_recvfrom.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "21e1cf688fb0397788c8dd42e1e0b08d58ac5c7b",
                  "status": "affected",
                  "version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
                  "versionType": "git"
                },
                {
                  "lessThan": "c1f8195bf68edd2cef0f18a4cead394075a54b5a",
                  "status": "affected",
                  "version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
                  "versionType": "git"
                },
                {
                  "lessThan": "838dd342962cef4c320632a5af48d3c31f2f9877",
                  "status": "affected",
                  "version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
                  "versionType": "git"
                },
                {
                  "lessThan": "4cbc3ba6dc2f746497cade60bcbaa82ae3696689",
                  "status": "affected",
                  "version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
                  "versionType": "git"
                },
                {
                  "lessThan": "e5c440c227ecdc721f2da0dd88b6358afd1031a7",
                  "status": "affected",
                  "version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
                  "versionType": "git"
                },
                {
                  "lessThan": "3c63d8946e578663b868cb9912dac616ea68bfd0",
                  "status": "affected",
                  "version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "net/sunrpc/xprtrdma/svc_rdma_recvfrom.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.11"
                },
                {
                  "lessThan": "5.11",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.174",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.120",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.64",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.11.*",
                  "status": "unaffected",
                  "version": "6.11.11",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.12.*",
                  "status": "unaffected",
                  "version": "6.12.2",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.13",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.174",
                      "versionStartIncluding": "5.11",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.120",
                      "versionStartIncluding": "5.11",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.64",
                      "versionStartIncluding": "5.11",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.11.11",
                      "versionStartIncluding": "5.11",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.12.2",
                      "versionStartIncluding": "5.11",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.13",
                      "versionStartIncluding": "5.11",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Address an integer overflow\n\nDan Carpenter reports:\n\u003e Commit 78147ca8b4a9 (\"svcrdma: Add a \"parsed chunk list\" data\n\u003e structure\") from Jun 22, 2020 (linux-next), leads to the following\n\u003e Smatch static checker warning:\n\u003e\n\u003e\tnet/sunrpc/xprtrdma/svc_rdma_recvfrom.c:498 xdr_check_write_chunk()\n\u003e\twarn: potential user controlled sizeof overflow \u0027segcount * 4 * 4\u0027\n\u003e\n\u003e net/sunrpc/xprtrdma/svc_rdma_recvfrom.c\n\u003e     488 static bool xdr_check_write_chunk(struct svc_rdma_recv_ctxt *rctxt)\n\u003e     489 {\n\u003e     490         u32 segcount;\n\u003e     491         __be32 *p;\n\u003e     492\n\u003e     493         if (xdr_stream_decode_u32(\u0026rctxt-\u003erc_stream, \u0026segcount))\n\u003e                                                               ^^^^^^^^\n\u003e\n\u003e     494                 return false;\n\u003e     495\n\u003e     496         /* A bogus segcount causes this buffer overflow check to fail. */\n\u003e     497         p = xdr_inline_decode(\u0026rctxt-\u003erc_stream,\n\u003e --\u003e 498                               segcount * rpcrdma_segment_maxsz * sizeof(*p));\n\u003e\n\u003e\n\u003e segcount is an untrusted u32.  On 32bit systems anything \u003e= SIZE_MAX / 16 will\n\u003e have an integer overflow and some those values will be accepted by\n\u003e xdr_inline_decode()."
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-05-04T09:54:20.631Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/21e1cf688fb0397788c8dd42e1e0b08d58ac5c7b"
            },
            {
              "url": "https://git.kernel.org/stable/c/c1f8195bf68edd2cef0f18a4cead394075a54b5a"
            },
            {
              "url": "https://git.kernel.org/stable/c/838dd342962cef4c320632a5af48d3c31f2f9877"
            },
            {
              "url": "https://git.kernel.org/stable/c/4cbc3ba6dc2f746497cade60bcbaa82ae3696689"
            },
            {
              "url": "https://git.kernel.org/stable/c/e5c440c227ecdc721f2da0dd88b6358afd1031a7"
            },
            {
              "url": "https://git.kernel.org/stable/c/3c63d8946e578663b868cb9912dac616ea68bfd0"
            }
          ],
          "title": "svcrdma: Address an integer overflow",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-53151",
        "datePublished": "2024-12-24T11:28:50.917Z",
        "dateReserved": "2024-11-19T17:17:25.000Z",
        "dateUpdated": "2025-10-01T20:17:09.093Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.