CVE-2024-42288 (GCVE-0-2024-42288)
Vulnerability from cvelistv5 – Published: 2024-08-17 09:08 – Updated: 2026-08-05 11:36
VLAI
EPSS
VEX
Title
scsi: qla2xxx: Fix for possible memory corruption
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Fix for possible memory corruption
Init Control Block is dereferenced incorrectly. Correctly dereference ICB
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 16:11 UTC
Assigner
References
9 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
0645cb8350cdb60bfbf91caa722984b81c215add , < dae67169cb35a37ecccf60cfcd6bf93a1f4f5efb
(git)
Affected: 0645cb8350cdb60bfbf91caa722984b81c215add , < 87db8d7b7520e99de71791260989f06f9c94953d (git) Affected: 0645cb8350cdb60bfbf91caa722984b81c215add , < b0302ffc74123b6a99d7d1896fcd9b2e4072d9ce (git) Affected: 0645cb8350cdb60bfbf91caa722984b81c215add , < 2a15b59a2c5afac89696e44acf5bbfc0599c6c5e (git) Affected: 0645cb8350cdb60bfbf91caa722984b81c215add , < 571d7f2a08836698c2fb0d792236424575b9829b (git) Affected: 0645cb8350cdb60bfbf91caa722984b81c215add , < 8192c533e89d9fb69b2490398939236b78cda79b (git) Affected: 0645cb8350cdb60bfbf91caa722984b81c215add , < c03d740152f78e86945a75b2ad541bf972fab92a (git) |
guessed | |
| Linux | Linux |
Affected:
4.20
Unaffected: 0 , < 4.20 (semver) Unaffected: 5.4.282 , ≤ 5.4.* (semver) Unaffected: 5.10.224 , ≤ 5.10.* (semver) Unaffected: 5.15.165 , ≤ 5.15.* (semver) Unaffected: 6.1.103 , ≤ 6.1.* (semver) Unaffected: 6.6.44 , ≤ 6.6.* (semver) Unaffected: 6.10.3 , ≤ 6.10.* (semver) Unaffected: 6.11 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-42288",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-10T16:11:13.401777Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-12T17:33:30.047Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T22:03:40.875Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/qla2xxx/qla_os.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "dae67169cb35a37ecccf60cfcd6bf93a1f4f5efb",
"status": "affected",
"version": "0645cb8350cdb60bfbf91caa722984b81c215add",
"versionType": "git"
},
{
"lessThan": "87db8d7b7520e99de71791260989f06f9c94953d",
"status": "affected",
"version": "0645cb8350cdb60bfbf91caa722984b81c215add",
"versionType": "git"
},
{
"lessThan": "b0302ffc74123b6a99d7d1896fcd9b2e4072d9ce",
"status": "affected",
"version": "0645cb8350cdb60bfbf91caa722984b81c215add",
"versionType": "git"
},
{
"lessThan": "2a15b59a2c5afac89696e44acf5bbfc0599c6c5e",
"status": "affected",
"version": "0645cb8350cdb60bfbf91caa722984b81c215add",
"versionType": "git"
},
{
"lessThan": "571d7f2a08836698c2fb0d792236424575b9829b",
"status": "affected",
"version": "0645cb8350cdb60bfbf91caa722984b81c215add",
"versionType": "git"
},
{
"lessThan": "8192c533e89d9fb69b2490398939236b78cda79b",
"status": "affected",
"version": "0645cb8350cdb60bfbf91caa722984b81c215add",
"versionType": "git"
},
{
"lessThan": "c03d740152f78e86945a75b2ad541bf972fab92a",
"status": "affected",
"version": "0645cb8350cdb60bfbf91caa722984b81c215add",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/qla2xxx/qla_os.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.20"
},
{
"lessThan": "4.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.282",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.10.*",
"status": "unaffected",
"version": "6.10.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.11",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.282",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.224",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.165",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.103",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.44",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.10.3",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.11",
"versionStartIncluding": "4.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix for possible memory corruption\n\nInit Control Block is dereferenced incorrectly. Correctly dereference ICB"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The corrupting write lives on the qla2xxx adapter-initialization path, driven by locally-set module parameters/sysfs attributes and firmware-reported exchange limits, not by any remotely supplied data. Reaching it requires local access to the host that owns the FC HBA.\nAC:L - The bad dereference is unconditional and deterministic once the adapter is in target or dual mode with exchange offload enabled \u2014 no race, no timing window, and no dependence on memory layout the attacker cannot influence.\nPR:L - On an FC target deployment already configured for exchange offload (target/dual mode with counts above 2048), no elevated capability is needed to reach the corrupting path \u2014 it re-executes on every adapter re-initialization, which an ordinary local user with storage-stack access can induce via host-reset/ISP-abort paths.\nUI:N - The corruption occurs automatically during adapter initialization and re-initialization; no victim action of any kind is required.\nS:U - The corrupted `init_cb_size` and the resulting out-of-bounds writes and mismatched DMA frees all stay within the kernel\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - An inflated `init_cb_size` is passed straight to `qla2x00_init_firmware()`, causing the HBA to DMA-read far past the ~5.2 KB coherent ICB allocation and expose adjacent kernel memory to the device; the page-allocator corruption from the mismatched `dma_free_coherent()` further yields read primitives over reused memory.\nI:H - The bug is a direct 16-bit write into an adjacent kernel struct field, which then drives `memset(ha-\u003einit_cb, 0, ha-\u003einit_cb_size)` out of bounds and frees page frames that were never allocated \u2014 classic heap/page-allocator corruption leveragable into a controlled write and control-flow hijack.\nA:H - Out-of-bounds writes and freeing unowned pages readily produce allocator corruption and kernel panics, and a malformed Init Control Block also leaves the HBA misconfigured, taking down storage connectivity on the affected host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T11:36:24.496Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/dae67169cb35a37ecccf60cfcd6bf93a1f4f5efb"
},
{
"url": "https://git.kernel.org/stable/c/87db8d7b7520e99de71791260989f06f9c94953d"
},
{
"url": "https://git.kernel.org/stable/c/b0302ffc74123b6a99d7d1896fcd9b2e4072d9ce"
},
{
"url": "https://git.kernel.org/stable/c/2a15b59a2c5afac89696e44acf5bbfc0599c6c5e"
},
{
"url": "https://git.kernel.org/stable/c/571d7f2a08836698c2fb0d792236424575b9829b"
},
{
"url": "https://git.kernel.org/stable/c/8192c533e89d9fb69b2490398939236b78cda79b"
},
{
"url": "https://git.kernel.org/stable/c/c03d740152f78e86945a75b2ad541bf972fab92a"
}
],
"title": "scsi: qla2xxx: Fix for possible memory corruption",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-42288",
"datePublished": "2024-08-17T09:08:53.466Z",
"dateReserved": "2024-07-30T07:40:12.262Z",
"dateUpdated": "2026-08-05T11:36:24.496Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2024-42288",
"date": "2026-09-13",
"epss": "0.00244",
"percentile": "0.15643"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2024-42288\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-17T09:15:09.523\",\"lastModified\":\"2026-08-04T11:19:47.507\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: qla2xxx: Fix for possible memory corruption\\n\\nInit Control Block is dereferenced incorrectly. Correctly dereference ICB\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: scsi: qla2xxx: Correcci\u00f3n de posible corrupci\u00f3n de la memoria Init Control Block est\u00e1 desreferenciada incorrectamente. Desreferenciar correctamente ICB\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/scsi/qla2xxx/qla_os.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"0645cb8350cdb60bfbf91caa722984b81c215add\",\"lessThan\":\"dae67169cb35a37ecccf60cfcd6bf93a1f4f5efb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0645cb8350cdb60bfbf91caa722984b81c215add\",\"lessThan\":\"87db8d7b7520e99de71791260989f06f9c94953d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0645cb8350cdb60bfbf91caa722984b81c215add\",\"lessThan\":\"b0302ffc74123b6a99d7d1896fcd9b2e4072d9ce\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0645cb8350cdb60bfbf91caa722984b81c215add\",\"lessThan\":\"2a15b59a2c5afac89696e44acf5bbfc0599c6c5e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0645cb8350cdb60bfbf91caa722984b81c215add\",\"lessThan\":\"571d7f2a08836698c2fb0d792236424575b9829b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0645cb8350cdb60bfbf91caa722984b81c215add\",\"lessThan\":\"8192c533e89d9fb69b2490398939236b78cda79b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0645cb8350cdb60bfbf91caa722984b81c215add\",\"lessThan\":\"c03d740152f78e86945a75b2ad541bf972fab92a\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/scsi/qla2xxx/qla_os.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.20\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.20\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.282\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.224\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.165\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.103\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.44\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.3\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T16:11:13.401777Z\",\"id\":\"CVE-2024-42288\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.4.282\",\"matchCriteriaId\":\"9B9D49AA-E82F-497B-A047-F07DF6F16995\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.224\",\"matchCriteriaId\":\"5CCEDF13-293D-4E64-B501-4409D0365AFE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.165\",\"matchCriteriaId\":\"B4E2B568-3171-41DE-B519-F2B1A3600D94\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.103\",\"matchCriteriaId\":\"E45EAC72-8329-4F99-8276-86AF9BB3496A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.44\",\"matchCriteriaId\":\"CC912330-6B41-4C6B-99AF-F3857FBACB6A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.3\",\"matchCriteriaId\":\"92D388F2-1EAF-4CFA-AC06-5B26D762EA7D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2a15b59a2c5afac89696e44acf5bbfc0599c6c5e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/571d7f2a08836698c2fb0d792236424575b9829b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8192c533e89d9fb69b2490398939236b78cda79b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/87db8d7b7520e99de71791260989f06f9c94953d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b0302ffc74123b6a99d7d1896fcd9b2e4072d9ce\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c03d740152f78e86945a75b2ad541bf972fab92a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dae67169cb35a37ecccf60cfcd6bf93a1f4f5efb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-08-04T18:33:02+00:00",
"cve": "CVE-2024-42288",
"id": "CVE-2024-42288",
"initial_release_date": "2024-08-17T00:00:00+00:00",
"product_status:known_affected": "198",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: scsi: qla2xxx: Fix for possible memory corruption",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-42288.json",
"version": "3"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:03:40.875Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-42288\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:11:13.401777Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:23.720Z\"}}], \"cna\": {\"title\": \"scsi: qla2xxx: Fix for possible memory corruption\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"0645cb8350cdb60bfbf91caa722984b81c215add\", \"lessThan\": \"dae67169cb35a37ecccf60cfcd6bf93a1f4f5efb\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0645cb8350cdb60bfbf91caa722984b81c215add\", \"lessThan\": \"87db8d7b7520e99de71791260989f06f9c94953d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0645cb8350cdb60bfbf91caa722984b81c215add\", \"lessThan\": \"b0302ffc74123b6a99d7d1896fcd9b2e4072d9ce\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0645cb8350cdb60bfbf91caa722984b81c215add\", \"lessThan\": \"2a15b59a2c5afac89696e44acf5bbfc0599c6c5e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0645cb8350cdb60bfbf91caa722984b81c215add\", \"lessThan\": \"571d7f2a08836698c2fb0d792236424575b9829b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0645cb8350cdb60bfbf91caa722984b81c215add\", \"lessThan\": \"8192c533e89d9fb69b2490398939236b78cda79b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0645cb8350cdb60bfbf91caa722984b81c215add\", \"lessThan\": \"c03d740152f78e86945a75b2ad541bf972fab92a\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/scsi/qla2xxx/qla_os.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.20\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.20\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.282\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.224\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.165\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.103\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.44\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/scsi/qla2xxx/qla_os.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/dae67169cb35a37ecccf60cfcd6bf93a1f4f5efb\"}, {\"url\": \"https://git.kernel.org/stable/c/87db8d7b7520e99de71791260989f06f9c94953d\"}, {\"url\": \"https://git.kernel.org/stable/c/b0302ffc74123b6a99d7d1896fcd9b2e4072d9ce\"}, {\"url\": \"https://git.kernel.org/stable/c/2a15b59a2c5afac89696e44acf5bbfc0599c6c5e\"}, {\"url\": \"https://git.kernel.org/stable/c/571d7f2a08836698c2fb0d792236424575b9829b\"}, {\"url\": \"https://git.kernel.org/stable/c/8192c533e89d9fb69b2490398939236b78cda79b\"}, {\"url\": \"https://git.kernel.org/stable/c/c03d740152f78e86945a75b2ad541bf972fab92a\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: qla2xxx: Fix for possible memory corruption\\n\\nInit Control Block is dereferenced incorrectly. Correctly dereference ICB\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.282\", \"versionStartIncluding\": \"4.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.224\", \"versionStartIncluding\": \"4.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.165\", \"versionStartIncluding\": \"4.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.103\", \"versionStartIncluding\": \"4.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.44\", \"versionStartIncluding\": \"4.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.3\", \"versionStartIncluding\": \"4.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"4.20\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-01-05T10:52:12.919Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-42288\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-01-05T10:52:12.919Z\", \"dateReserved\": \"2024-07-30T07:40:12.262Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-17T09:08:53.466Z\", \"assignerShortName\": \"Linux\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…