GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89674 (GCVE-0-2026-89674)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:45 – Updated: 2026-09-14 12:01
VLAI
Title
nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget
Summary
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget The XDR buffer size calculation in nfsd4_ff_encode_layoutget() has multiple errors that can result in either an out-of-bounds write or leaking uninitialized kernel memory to the client: - fh_len doesn't account for XDR padding on the file handle data - uid and gid lengths use "8 + len" but xdr_encode_opaque() actually writes "4 + xdr_align_size(len)" bytes - ds_len omits the flags and stats_collect_hint fields (8 bytes), while len's header constant overestimates by 8 bytes -- these partially cancel but leave a net mismatch The worst case occurs with short strings (e.g. uid=0, gid=0 with an odd-sized file handle), where the function writes up to 5 bytes past the reserved XDR buffer. Conversely, when string lengths happen to be 4-byte aligned, the reservation is too large and stale buffer content is sent to the client. Fix this by breaking out every encoded field explicitly in the ds_len calculation, using xdr_align_size() for all variable-length opaque fields, and correcting the header constants.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9b9960a0ca4773e21c4b153ed355583946346b25 , < 3a7fd224df0fbb42167eb1b77be45d72fe0b1098 (git)
Affected: 9b9960a0ca4773e21c4b153ed355583946346b25 , < 29e4478e2ed5a227e8f0c33cacb91bf227cedd47 (git)
Affected: 9b9960a0ca4773e21c4b153ed355583946346b25 , < 65a72b721943618eeb3a41c8b36e915591f3f83f (git)
Affected: 9b9960a0ca4773e21c4b153ed355583946346b25 , < bee826c00ac900473f91306f1f3e5a5a81fd4a74 (git)
Affected: 9b9960a0ca4773e21c4b153ed355583946346b25 , < e7d9d23ecd9172f05b09bb678ff22db8e361c428 (git)
Affected: 9b9960a0ca4773e21c4b153ed355583946346b25 , < 0380129b1373c437eb35401a174671c8888f4b80 (git)
Affected: 9b9960a0ca4773e21c4b153ed355583946346b25 , < c81cef6a805dec266c10fc4f83c93d6fcf1a2b43 (git)
Affected: 9b9960a0ca4773e21c4b153ed355583946346b25 , < f9868174af49d207fbaf0c5e055d088a983684af (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.8
Unaffected: 0 , < 4.8 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/flexfilelayoutxdr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3a7fd224df0fbb42167eb1b77be45d72fe0b1098",
              "status": "affected",
              "version": "9b9960a0ca4773e21c4b153ed355583946346b25",
              "versionType": "git"
            },
            {
              "lessThan": "29e4478e2ed5a227e8f0c33cacb91bf227cedd47",
              "status": "affected",
              "version": "9b9960a0ca4773e21c4b153ed355583946346b25",
              "versionType": "git"
            },
            {
              "lessThan": "65a72b721943618eeb3a41c8b36e915591f3f83f",
              "status": "affected",
              "version": "9b9960a0ca4773e21c4b153ed355583946346b25",
              "versionType": "git"
            },
            {
              "lessThan": "bee826c00ac900473f91306f1f3e5a5a81fd4a74",
              "status": "affected",
              "version": "9b9960a0ca4773e21c4b153ed355583946346b25",
              "versionType": "git"
            },
            {
              "lessThan": "e7d9d23ecd9172f05b09bb678ff22db8e361c428",
              "status": "affected",
              "version": "9b9960a0ca4773e21c4b153ed355583946346b25",
              "versionType": "git"
            },
            {
              "lessThan": "0380129b1373c437eb35401a174671c8888f4b80",
              "status": "affected",
              "version": "9b9960a0ca4773e21c4b153ed355583946346b25",
              "versionType": "git"
            },
            {
              "lessThan": "c81cef6a805dec266c10fc4f83c93d6fcf1a2b43",
              "status": "affected",
              "version": "9b9960a0ca4773e21c4b153ed355583946346b25",
              "versionType": "git"
            },
            {
              "lessThan": "f9868174af49d207fbaf0c5e055d088a983684af",
              "status": "affected",
              "version": "9b9960a0ca4773e21c4b153ed355583946346b25",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/flexfilelayoutxdr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.8"
            },
            {
              "lessThan": "4.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget\n\nThe XDR buffer size calculation in nfsd4_ff_encode_layoutget() has\nmultiple errors that can result in either an out-of-bounds write or\nleaking uninitialized kernel memory to the client:\n\n - fh_len doesn\u0027t account for XDR padding on the file handle data\n - uid and gid lengths use \"8 + len\" but xdr_encode_opaque() actually\n   writes \"4 + xdr_align_size(len)\" bytes\n - ds_len omits the flags and stats_collect_hint fields (8 bytes),\n   while len\u0027s header constant overestimates by 8 bytes -- these\n   partially cancel but leave a net mismatch\n\nThe worst case occurs with short strings (e.g. uid=0, gid=0 with an\nodd-sized file handle), where the function writes up to 5 bytes past\nthe reserved XDR buffer. Conversely, when string lengths happen to be\n4-byte aligned, the reservation is too large and stale buffer content\nis sent to the client.\n\nFix this by breaking out every encoded field explicitly in the ds_len\ncalculation, using xdr_align_size() for all variable-length opaque\nfields, and correcting the header constants."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in nfsd\u0027s pNFS flexfile LAYOUTGET encoder (nfsd4_ff_encode_layoutget). A remote NFSv4.1 client reaches it over TCP/2049 via COMPOUND SEQUENCE, PUTFH, OPEN, and LAYOUTGET on the in-kernel NFS server.\nAC:L - A client that can OPEN a file on a flexfile pNFS export issues LAYOUTGET and hits the miscalculated xdr_reserve_space length. Root-owned files yield uid/gid \"0\", and PUTFH may append 1-3 bytes ignored by fh_verify so fh.size is odd; no race is required.\nPR:N - Typical nfsd deployments accept AUTH_SYS/AUTH_NULL without cryptographic authentication. Any host allowed by the export ACL can EXCHANGE_ID/CREATE_SESSION, PUTFH/OPEN, and LAYOUTGET; no local account on the NFS server is required.\nUI:N - The attacking NFS client drives the compounds that open a file and request a flexfile layout. No victim user action such as mounting a filesystem or opening a file on the server is required.\nS:U - The out-of-bounds write and kernel-memory leak occur in the NFS server host\u0027s XDR reply buffer. Impact stays in that kernel security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - When the reservation is too large, stale uninitialized kernel bytes in the RPC reply are sent to the client. The matching out-of-bounds write is kernel memory corruption that can be leveraged for information disclosure per CVSS kernel guidance.\nI:H - Worst case the encoder writes up to 5 bytes past the xdr_reserve_space region, including across a reply-page boundary into adjacent kernel memory. Kernel CNA guidance scores out-of-bounds writes as High integrity impact.\nA:H - A write past the current XDR page (xdr-\u003eend) into an unmapped or unrelated page oopses or panics nfsd. The attacker can pad prior COMPOUND ops to place the LAYOUTGET encode at a page boundary and repeat the request to deny service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:01:59.946Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3a7fd224df0fbb42167eb1b77be45d72fe0b1098"
        },
        {
          "url": "https://git.kernel.org/stable/c/29e4478e2ed5a227e8f0c33cacb91bf227cedd47"
        },
        {
          "url": "https://git.kernel.org/stable/c/65a72b721943618eeb3a41c8b36e915591f3f83f"
        },
        {
          "url": "https://git.kernel.org/stable/c/bee826c00ac900473f91306f1f3e5a5a81fd4a74"
        },
        {
          "url": "https://git.kernel.org/stable/c/e7d9d23ecd9172f05b09bb678ff22db8e361c428"
        },
        {
          "url": "https://git.kernel.org/stable/c/0380129b1373c437eb35401a174671c8888f4b80"
        },
        {
          "url": "https://git.kernel.org/stable/c/c81cef6a805dec266c10fc4f83c93d6fcf1a2b43"
        },
        {
          "url": "https://git.kernel.org/stable/c/f9868174af49d207fbaf0c5e055d088a983684af"
        }
      ],
      "title": "nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89674",
    "datePublished": "2026-09-11T19:45:58.883Z",
    "dateReserved": "2026-09-11T19:38:34.746Z",
    "dateUpdated": "2026-09-14T12:01:59.946Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89674",
      "date": "2026-09-15",
      "epss": "0.00521",
      "percentile": "0.42767"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89674\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:54.013\",\"lastModified\":\"2026-09-14T13:19:19.450\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget\\n\\nThe XDR buffer size calculation in nfsd4_ff_encode_layoutget() has\\nmultiple errors that can result in either an out-of-bounds write or\\nleaking uninitialized kernel memory to the client:\\n\\n - fh_len doesn\u0027t account for XDR padding on the file handle data\\n - uid and gid lengths use \\\"8 + len\\\" but xdr_encode_opaque() actually\\n   writes \\\"4 + xdr_align_size(len)\\\" bytes\\n - ds_len omits the flags and stats_collect_hint fields (8 bytes),\\n   while len\u0027s header constant overestimates by 8 bytes -- these\\n   partially cancel but leave a net mismatch\\n\\nThe worst case occurs with short strings (e.g. uid=0, gid=0 with an\\nodd-sized file handle), where the function writes up to 5 bytes past\\nthe reserved XDR buffer. Conversely, when string lengths happen to be\\n4-byte aligned, the reservation is too large and stale buffer content\\nis sent to the client.\\n\\nFix this by breaking out every encoded field explicitly in the ds_len\\ncalculation, using xdr_align_size() for all variable-length opaque\\nfields, and correcting the header constants.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/nfsd/flexfilelayoutxdr.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9b9960a0ca4773e21c4b153ed355583946346b25\",\"lessThan\":\"3a7fd224df0fbb42167eb1b77be45d72fe0b1098\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9b9960a0ca4773e21c4b153ed355583946346b25\",\"lessThan\":\"29e4478e2ed5a227e8f0c33cacb91bf227cedd47\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9b9960a0ca4773e21c4b153ed355583946346b25\",\"lessThan\":\"65a72b721943618eeb3a41c8b36e915591f3f83f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9b9960a0ca4773e21c4b153ed355583946346b25\",\"lessThan\":\"bee826c00ac900473f91306f1f3e5a5a81fd4a74\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9b9960a0ca4773e21c4b153ed355583946346b25\",\"lessThan\":\"e7d9d23ecd9172f05b09bb678ff22db8e361c428\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9b9960a0ca4773e21c4b153ed355583946346b25\",\"lessThan\":\"0380129b1373c437eb35401a174671c8888f4b80\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9b9960a0ca4773e21c4b153ed355583946346b25\",\"lessThan\":\"c81cef6a805dec266c10fc4f83c93d6fcf1a2b43\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9b9960a0ca4773e21c4b153ed355583946346b25\",\"lessThan\":\"f9868174af49d207fbaf0c5e055d088a983684af\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/nfsd/flexfilelayoutxdr.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.270\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.221\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.188\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0380129b1373c437eb35401a174671c8888f4b80\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/29e4478e2ed5a227e8f0c33cacb91bf227cedd47\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3a7fd224df0fbb42167eb1b77be45d72fe0b1098\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/65a72b721943618eeb3a41c8b36e915591f3f83f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bee826c00ac900473f91306f1f3e5a5a81fd4a74\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c81cef6a805dec266c10fc4f83c93d6fcf1a2b43\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e7d9d23ecd9172f05b09bb678ff22db8e361c428\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f9868174af49d207fbaf0c5e055d088a983684af\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-13T06:51:44+00:00",
      "cve": "CVE-2026-89674",
      "id": "CVE-2026-89674",
      "initial_release_date": "2026-09-11T19:45:58.883000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux Kernel nfsd: Memory corruption and information disclosure via XDR length calculation error.",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89674.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-16T00:00:32Z",
      "cve": "CVE-2026-89674",
      "id": "CVE-2026-89674",
      "initial_release_date": "2026-09-12T16:23:54Z",
      "product_status:known_affected": "347",
      "product_status:known_not_affected": "6",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89674",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89674.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.