CVE-2024-47682 (GCVE-0-2024-47682)

Vulnerability from cvelistv5 – Published: 2024-10-21 11:53 – Updated: 2026-08-05 11:39
VLAI
Title
scsi: sd: Fix off-by-one error in sd_read_block_characteristics()
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix off-by-one error in sd_read_block_characteristics() Ff the device returns page 0xb1 with length 8 (happens with qemu v2.x, for example), sd_read_block_characteristics() may attempt an out-of-bounds memory access when accessing the zoned field at offset 8.
Severity
8.6 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-21 13:07 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7fb019c46eeea4e3cc3ddfd3e01a24e610f34fac , < 60312ae7392f9c75c6591a52fc359cf7f810d48f (git)
Affected: 7fb019c46eeea4e3cc3ddfd3e01a24e610f34fac , < 568c7c4c77eee6df7677bb861b7cee7398a3255d (git)
Affected: 7fb019c46eeea4e3cc3ddfd3e01a24e610f34fac , < a776050373893e4c847a49abeae2ccb581153df0 (git)
Affected: 7fb019c46eeea4e3cc3ddfd3e01a24e610f34fac , < 413df704f149dec585df07466d2401bbd1f490a0 (git)
Affected: 7fb019c46eeea4e3cc3ddfd3e01a24e610f34fac , < f81eaf08385ddd474a2f41595a7757502870c0eb (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.19
Unaffected: 0 , < 5.19 (semver)
Unaffected: 6.1.113 , ≤ 6.1.* (semver)
Unaffected: 6.6.54 , ≤ 6.6.* (semver)
Unaffected: 6.10.13 , ≤ 6.10.* (semver)
Unaffected: 6.11.2 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47682",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-21T13:07:09.255382Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-21T13:14:16.478Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:20:47.796Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/sd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "60312ae7392f9c75c6591a52fc359cf7f810d48f",
              "status": "affected",
              "version": "7fb019c46eeea4e3cc3ddfd3e01a24e610f34fac",
              "versionType": "git"
            },
            {
              "lessThan": "568c7c4c77eee6df7677bb861b7cee7398a3255d",
              "status": "affected",
              "version": "7fb019c46eeea4e3cc3ddfd3e01a24e610f34fac",
              "versionType": "git"
            },
            {
              "lessThan": "a776050373893e4c847a49abeae2ccb581153df0",
              "status": "affected",
              "version": "7fb019c46eeea4e3cc3ddfd3e01a24e610f34fac",
              "versionType": "git"
            },
            {
              "lessThan": "413df704f149dec585df07466d2401bbd1f490a0",
              "status": "affected",
              "version": "7fb019c46eeea4e3cc3ddfd3e01a24e610f34fac",
              "versionType": "git"
            },
            {
              "lessThan": "f81eaf08385ddd474a2f41595a7757502870c0eb",
              "status": "affected",
              "version": "7fb019c46eeea4e3cc3ddfd3e01a24e610f34fac",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/sd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.113",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.54",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.13",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.2",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: sd: Fix off-by-one error in sd_read_block_characteristics()\n\nFf the device returns page 0xb1 with length 8 (happens with qemu v2.x, for\nexample), sd_read_block_characteristics() may attempt an out-of-bounds\nmemory access when accessing the zoned field at offset 8."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The out-of-bounds read is driven entirely by the SCSI target\u0027s INQUIRY VPD page 0xb1 response, and the sd driver sits on top of network transports (iSCSI over TCP/3260, SRP, FCoE) where that response arrives from a remote peer. A malicious or compromised target \u2014 or an attacker spoofing/MITM\u0027ing a commonly-unauthenticated iSCSI session \u2014 supplies the short page directly over the network.\nAC:L - The target simply reports page 0xb1 with a page length of 4 (total length 8), which makes vpd-\u003elen == 8 pass the `\u003c 8` check and the read of data[8] occur deterministically on every probe/rescan. This is a real-world occurrence (qemu 2.x), requiring no timing, layout, or race conditions.\nPR:N - The remote target holds no privileges on the initiator host; the malformed VPD page is consumed unconditionally during device discovery/revalidation with no authentication or capability check on the initiator side. iSCSI is frequently deployed without CHAP, so no credentials are needed.\nUI:N - No operator action is required \u2014 sd_revalidate_disk() runs automatically on probe, on iSCSI session reconnect, and on rescan, so the attacker-controlled response is parsed without any victim interaction.\nS:U - The OOB read and its consequences are confined to the kernel\u0027s own memory and the SCSI/block layer\u0027s data structures; no security authority boundary such as a VM or IOMMU boundary is crossed.\nC:L - The read is strictly bounded to a single byte at a fixed offset past the VPD data, and only bits 4-5 of it become observable, surfacing through /sys/block/sdX/device/zoned_cap and the dmesg classification message. The attacker cannot scan or seek to arbitrary memory, so the disclosure of uninitialized heap content is limited.\nI:L - Uninitialized/out-of-bounds heap content is written into sdkp-\u003ezoned and then used to configure the block device\u0027s zoned model via disk_set_zoned(), so uncontrolled data modifies persistent kernel device state. The modification is limited and not attacker-chosen, so it does not amount to an arbitrary write.\nA:H - When the stale byte yields zoned == 1, a normal disk is misclassified as host-aware zoned and sd_zbc_read_zones() fails, driving the error path that sets sdkp-\u003ecapacity = 0 and zeroes the gendisk capacity \u2014 the storage device becomes unusable, which is fatal if it is the boot/root disk. Additionally the access crosses the kmalloc request boundary on 32-bit and under KFENCE/KASAN, producing a slab-out-of-bounds report that panics on panic_on_warn configurations."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:39:26.150Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/60312ae7392f9c75c6591a52fc359cf7f810d48f"
        },
        {
          "url": "https://git.kernel.org/stable/c/568c7c4c77eee6df7677bb861b7cee7398a3255d"
        },
        {
          "url": "https://git.kernel.org/stable/c/a776050373893e4c847a49abeae2ccb581153df0"
        },
        {
          "url": "https://git.kernel.org/stable/c/413df704f149dec585df07466d2401bbd1f490a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/f81eaf08385ddd474a2f41595a7757502870c0eb"
        }
      ],
      "title": "scsi: sd: Fix off-by-one error in sd_read_block_characteristics()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-47682",
    "datePublished": "2024-10-21T11:53:24.460Z",
    "dateReserved": "2024-09-30T16:00:12.941Z",
    "dateUpdated": "2026-08-05T11:39:26.150Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-47682",
      "date": "2026-10-01",
      "epss": "0.00536",
      "percentile": "0.43124"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "7D848431-3C7A-4C40-BC35-515047E89ABE",
                  "versionEndExcluding": "6.1.113",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "D448821D-C085-4CAF-88FA-2DDE7BE21976",
                  "versionEndExcluding": "6.6.54",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "CE94BB8D-B0AB-4563-9ED7-A12122B56EBE",
                  "versionEndExcluding": "6.10.13",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "AB755D26-97F4-43B6-8604-CD076811E181",
                  "versionEndExcluding": "6.11.2",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: sd: Fix off-by-one error in sd_read_block_characteristics()\n\nFf the device returns page 0xb1 with length 8 (happens with qemu v2.x, for\nexample), sd_read_block_characteristics() may attempt an out-of-bounds\nmemory access when accessing the zoned field at offset 8."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: scsi: sd: Se corrige el error de un byte en sd_read_block_characteristics() Si el dispositivo devuelve la p\u00e1gina 0xb1 con una longitud de 8 (sucede con qemu v2.x, por ejemplo), sd_read_block_characteristics() puede intentar un acceso a la memoria fuera de los l\u00edmites al acceder al campo zonificado en el desplazamiento 8."
        }
      ],
      "id": "CVE-2024-47682",
      "lastModified": "2024-10-23T14:57:12.700",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 1.8,
            "impactScore": 5.9,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2024-10-21T12:15:05.143",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/413df704f149dec585df07466d2401bbd1f490a0"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/568c7c4c77eee6df7677bb861b7cee7398a3255d"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/60312ae7392f9c75c6591a52fc359cf7f810d48f"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/a776050373893e4c847a49abeae2ccb581153df0"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/f81eaf08385ddd474a2f41595a7757502870c0eb"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-193"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "microsoft_vex": {
      "current_release_date": "2024-11-09T00:00:00.000Z",
      "cve": "CVE-2024-47682",
      "id": "msrc_CVE-2024-47682",
      "initial_release_date": "2024-10-01T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "scsi: sd: Fix off-by-one error in sd_read_block_characteristics()",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-47682.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/scsi/sd.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "60312ae7392f9c75c6591a52fc359cf7f810d48f",
                    "status": "affected",
                    "version": "7fb019c46eeea4e3cc3ddfd3e01a24e610f34fac",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "568c7c4c77eee6df7677bb861b7cee7398a3255d",
                    "status": "affected",
                    "version": "7fb019c46eeea4e3cc3ddfd3e01a24e610f34fac",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a776050373893e4c847a49abeae2ccb581153df0",
                    "status": "affected",
                    "version": "7fb019c46eeea4e3cc3ddfd3e01a24e610f34fac",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "413df704f149dec585df07466d2401bbd1f490a0",
                    "status": "affected",
                    "version": "7fb019c46eeea4e3cc3ddfd3e01a24e610f34fac",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f81eaf08385ddd474a2f41595a7757502870c0eb",
                    "status": "affected",
                    "version": "7fb019c46eeea4e3cc3ddfd3e01a24e610f34fac",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/scsi/sd.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.19"
                  },
                  {
                    "lessThan": "5.19",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.113",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.54",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.10.*",
                    "status": "unaffected",
                    "version": "6.10.13",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.11.*",
                    "status": "unaffected",
                    "version": "6.11.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.12",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7D848431-3C7A-4C40-BC35-515047E89ABE",
                    "versionEndExcluding": "6.1.113",
                    "versionStartIncluding": "5.19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D448821D-C085-4CAF-88FA-2DDE7BE21976",
                    "versionEndExcluding": "6.6.54",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CE94BB8D-B0AB-4563-9ED7-A12122B56EBE",
                    "versionEndExcluding": "6.10.13",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AB755D26-97F4-43B6-8604-CD076811E181",
                    "versionEndExcluding": "6.11.2",
                    "versionStartIncluding": "6.11",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: sd: Fix off-by-one error in sd_read_block_characteristics()\n\nFf the device returns page 0xb1 with length 8 (happens with qemu v2.x, for\nexample), sd_read_block_characteristics() may attempt an out-of-bounds\nmemory access when accessing the zoned field at offset 8."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: scsi: sd: Se corrige el error de un byte en sd_read_block_characteristics() Si el dispositivo devuelve la p\u00e1gina 0xb1 con una longitud de 8 (sucede con qemu v2.x, por ejemplo), sd_read_block_characteristics() puede intentar un acceso a la memoria fuera de los l\u00edmites al acceder al campo zonificado en el desplazamiento 8."
          }
        ],
        "id": "CVE-2024-47682",
        "lastModified": "2026-08-04T11:20:39.753",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.6,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 4.7,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-47682",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-21T13:07:09.255382Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-10-21T12:15:05.143",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/413df704f149dec585df07466d2401bbd1f490a0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/568c7c4c77eee6df7677bb861b7cee7398a3255d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/60312ae7392f9c75c6591a52fc359cf7f810d48f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a776050373893e4c847a49abeae2ccb581153df0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f81eaf08385ddd474a2f41595a7757502870c0eb"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-193"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-10-01T00:07:04+00:00",
      "cve": "CVE-2024-47682",
      "id": "CVE-2024-47682",
      "initial_release_date": "2024-10-21T00:00:00+00:00",
      "product_status:known_affected": "150",
      "product_status:known_not_affected": "48",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: scsi: sd: Fix off-by-one error in sd_read_block_characteristics()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-47682.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T02:13:05Z",
      "cve": "CVE-2024-47682",
      "id": "CVE-2024-47682",
      "initial_release_date": "2024-10-21T15:47:47Z",
      "product_status:known_affected": "354",
      "product_status:known_not_affected": "381",
      "product_status:recommended": "636",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-47682",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-47682.json",
      "version": "64"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-47682",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-10-21T13:07:09.255382Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-10-21T13:07:12.473Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/scsi/sd.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "60312ae7392f9c75c6591a52fc359cf7f810d48f",
                  "status": "affected",
                  "version": "7fb019c46eeea4e3cc3ddfd3e01a24e610f34fac",
                  "versionType": "git"
                },
                {
                  "lessThan": "568c7c4c77eee6df7677bb861b7cee7398a3255d",
                  "status": "affected",
                  "version": "7fb019c46eeea4e3cc3ddfd3e01a24e610f34fac",
                  "versionType": "git"
                },
                {
                  "lessThan": "a776050373893e4c847a49abeae2ccb581153df0",
                  "status": "affected",
                  "version": "7fb019c46eeea4e3cc3ddfd3e01a24e610f34fac",
                  "versionType": "git"
                },
                {
                  "lessThan": "413df704f149dec585df07466d2401bbd1f490a0",
                  "status": "affected",
                  "version": "7fb019c46eeea4e3cc3ddfd3e01a24e610f34fac",
                  "versionType": "git"
                },
                {
                  "lessThan": "f81eaf08385ddd474a2f41595a7757502870c0eb",
                  "status": "affected",
                  "version": "7fb019c46eeea4e3cc3ddfd3e01a24e610f34fac",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/scsi/sd.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.19"
                },
                {
                  "lessThan": "5.19",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.113",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.54",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.10.*",
                  "status": "unaffected",
                  "version": "6.10.13",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.11.*",
                  "status": "unaffected",
                  "version": "6.11.2",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.12",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.113",
                      "versionStartIncluding": "5.19",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.54",
                      "versionStartIncluding": "5.19",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.10.13",
                      "versionStartIncluding": "5.19",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.11.2",
                      "versionStartIncluding": "5.19",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.12",
                      "versionStartIncluding": "5.19",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: sd: Fix off-by-one error in sd_read_block_characteristics()\n\nFf the device returns page 0xb1 with length 8 (happens with qemu v2.x, for\nexample), sd_read_block_characteristics() may attempt an out-of-bounds\nmemory access when accessing the zoned field at offset 8."
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-05-04T09:37:10.188Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/60312ae7392f9c75c6591a52fc359cf7f810d48f"
            },
            {
              "url": "https://git.kernel.org/stable/c/568c7c4c77eee6df7677bb861b7cee7398a3255d"
            },
            {
              "url": "https://git.kernel.org/stable/c/a776050373893e4c847a49abeae2ccb581153df0"
            },
            {
              "url": "https://git.kernel.org/stable/c/413df704f149dec585df07466d2401bbd1f490a0"
            },
            {
              "url": "https://git.kernel.org/stable/c/f81eaf08385ddd474a2f41595a7757502870c0eb"
            }
          ],
          "title": "scsi: sd: Fix off-by-one error in sd_read_block_characteristics()",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-47682",
        "datePublished": "2024-10-21T11:53:24.460Z",
        "dateReserved": "2024-09-30T16:00:12.941Z",
        "dateUpdated": "2025-05-04T09:37:10.188Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.