NetSight
IP …
high7.8

CVE-2024-50180

In the Linux kernel, the following vulnerability has been resolved: fbdev: sisfb: Fix strbuf array overflow The values of the variables xres and yres are place…

Impact

In the Linux kernel, the following vulnerability has been resolved: fbdev: sisfb: Fix strbuf array overflow The values of the variables xres and yres are placed in strbuf. These variables are obtained from strbuf1. The strbuf1 array contains digit characters and a space if the array contains non-digit characters. Then, when executing sprintf(strbuf, "%ux%ux8", xres, yres); more than 16 bytes will be written to strbuf. It is suggested to increase the size of the strbuf array to 24. Found by Linux Verification Center (linuxtesting.org) with SVACE.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
before 4.19.323
from 4.20 before 5.4.285
from 5.5 before 5.10.227
from 5.11 before 5.15.168
from 5.16 before 6.1.113
from 6.2 before 6.6.57

Weakness classification

CWE-787

References