CVE-2024-47742 (GCVE-0-2024-47742)

Vulnerability from cvelistv5 – Published: 2024-10-21 12:14 – Updated: 2026-08-05 11:39
VLAI
Title
firmware_loader: Block path traversal
Summary
In the Linux kernel, the following vulnerability has been resolved: firmware_loader: Block path traversal Most firmware names are hardcoded strings, or are constructed from fairly constrained format strings where the dynamic parts are just some hex numbers or such. However, there are a couple codepaths in the kernel where firmware file names contain string components that are passed through from a device or semi-privileged userspace; the ones I could find (not counting interfaces that require root privileges) are: - lpfc_sli4_request_firmware_update() seems to construct the firmware filename from "ModelName", a string that was previously parsed out of some descriptor ("Vital Product Data") in lpfc_fill_vpd() - nfp_net_fw_find() seems to construct a firmware filename from a model name coming from nfp_hwinfo_lookup(pf->hwinfo, "nffw.partno"), which I think parses some descriptor that was read from the device. (But this case likely isn't exploitable because the format string looks like "netronome/nic_%s", and there shouldn't be any *folders* starting with "netronome/nic_". The previous case was different because there, the "%s" is *at the start* of the format string.) - module_flash_fw_schedule() is reachable from the ETHTOOL_MSG_MODULE_FW_FLASH_ACT netlink command, which is marked as GENL_UNS_ADMIN_PERM (meaning CAP_NET_ADMIN inside a user namespace is enough to pass the privilege check), and takes a userspace-provided firmware name. (But I think to reach this case, you need to have CAP_NET_ADMIN over a network namespace that a special kind of ethernet device is mapped into, so I think this is not a viable attack path in practice.) Fix it by rejecting any firmware names containing ".." path components. For what it's worth, I went looking and haven't found any USB device drivers that use the firmware loader dangerously.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: abb139e75c2cdbb955e840d6331cb5863e409d0e , < d1768e5535d3ded59f888637016e6f821f4e069f (git)
Affected: abb139e75c2cdbb955e840d6331cb5863e409d0e , < 9b1ca33ebd05b3acef5b976c04e5e791af93ce1b (git)
Affected: abb139e75c2cdbb955e840d6331cb5863e409d0e , < c30558e6c5c9ad6c86459d9acce1520ceeab9ea6 (git)
Affected: abb139e75c2cdbb955e840d6331cb5863e409d0e , < a77fc4acfd49fc6076e565445b2bc5fdc3244da4 (git)
Affected: abb139e75c2cdbb955e840d6331cb5863e409d0e , < 3d2411f4edcb649eaf232160db459bb4770b5251 (git)
Affected: abb139e75c2cdbb955e840d6331cb5863e409d0e , < 7420c1bf7fc784e587b87329cc6dfa3dca537aa4 (git)
Affected: abb139e75c2cdbb955e840d6331cb5863e409d0e , < 28f1cd94d3f1092728fb775a0fe26c5f1ac2ebeb (git)
Affected: abb139e75c2cdbb955e840d6331cb5863e409d0e , < 6c4e13fdfcab34811c3143a0a03c05fec4e870ec (git)
Affected: abb139e75c2cdbb955e840d6331cb5863e409d0e , < f0e5311aa8022107d63c54e2f03684ec097d1394 (git)
Create a notification for this product.
Linux Linux Affected: 3.7
Unaffected: 0 , < 3.7 (semver)
Unaffected: 4.19.323 , ≤ 4.19.* (semver)
Unaffected: 5.4.285 , ≤ 5.4.* (semver)
Unaffected: 5.10.227 , ≤ 5.10.* (semver)
Unaffected: 5.15.168 , ≤ 5.15.* (semver)
Unaffected: 6.1.113 , ≤ 6.1.* (semver)
Unaffected: 6.6.54 , ≤ 6.6.* (semver)
Unaffected: 6.10.13 , ≤ 6.10.* (semver)
Unaffected: 6.11.2 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47742",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-21T12:59:04.060717Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-21T13:04:14.368Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:21:38.407Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/base/firmware_loader/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d1768e5535d3ded59f888637016e6f821f4e069f",
              "status": "affected",
              "version": "abb139e75c2cdbb955e840d6331cb5863e409d0e",
              "versionType": "git"
            },
            {
              "lessThan": "9b1ca33ebd05b3acef5b976c04e5e791af93ce1b",
              "status": "affected",
              "version": "abb139e75c2cdbb955e840d6331cb5863e409d0e",
              "versionType": "git"
            },
            {
              "lessThan": "c30558e6c5c9ad6c86459d9acce1520ceeab9ea6",
              "status": "affected",
              "version": "abb139e75c2cdbb955e840d6331cb5863e409d0e",
              "versionType": "git"
            },
            {
              "lessThan": "a77fc4acfd49fc6076e565445b2bc5fdc3244da4",
              "status": "affected",
              "version": "abb139e75c2cdbb955e840d6331cb5863e409d0e",
              "versionType": "git"
            },
            {
              "lessThan": "3d2411f4edcb649eaf232160db459bb4770b5251",
              "status": "affected",
              "version": "abb139e75c2cdbb955e840d6331cb5863e409d0e",
              "versionType": "git"
            },
            {
              "lessThan": "7420c1bf7fc784e587b87329cc6dfa3dca537aa4",
              "status": "affected",
              "version": "abb139e75c2cdbb955e840d6331cb5863e409d0e",
              "versionType": "git"
            },
            {
              "lessThan": "28f1cd94d3f1092728fb775a0fe26c5f1ac2ebeb",
              "status": "affected",
              "version": "abb139e75c2cdbb955e840d6331cb5863e409d0e",
              "versionType": "git"
            },
            {
              "lessThan": "6c4e13fdfcab34811c3143a0a03c05fec4e870ec",
              "status": "affected",
              "version": "abb139e75c2cdbb955e840d6331cb5863e409d0e",
              "versionType": "git"
            },
            {
              "lessThan": "f0e5311aa8022107d63c54e2f03684ec097d1394",
              "status": "affected",
              "version": "abb139e75c2cdbb955e840d6331cb5863e409d0e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/base/firmware_loader/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.7"
            },
            {
              "lessThan": "3.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.323",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.285",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.227",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.323",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.285",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.227",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.168",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.113",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.54",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.13",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.2",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware_loader: Block path traversal\n\nMost firmware names are hardcoded strings, or are constructed from fairly\nconstrained format strings where the dynamic parts are just some hex\nnumbers or such.\n\nHowever, there are a couple codepaths in the kernel where firmware file\nnames contain string components that are passed through from a device or\nsemi-privileged userspace; the ones I could find (not counting interfaces\nthat require root privileges) are:\n\n - lpfc_sli4_request_firmware_update() seems to construct the firmware\n   filename from \"ModelName\", a string that was previously parsed out of\n   some descriptor (\"Vital Product Data\") in lpfc_fill_vpd()\n - nfp_net_fw_find() seems to construct a firmware filename from a model\n   name coming from nfp_hwinfo_lookup(pf-\u003ehwinfo, \"nffw.partno\"), which I\n   think parses some descriptor that was read from the device.\n   (But this case likely isn\u0027t exploitable because the format string looks\n   like \"netronome/nic_%s\", and there shouldn\u0027t be any *folders* starting\n   with \"netronome/nic_\". The previous case was different because there,\n   the \"%s\" is *at the start* of the format string.)\n - module_flash_fw_schedule() is reachable from the\n   ETHTOOL_MSG_MODULE_FW_FLASH_ACT netlink command, which is marked as\n   GENL_UNS_ADMIN_PERM (meaning CAP_NET_ADMIN inside a user namespace is\n   enough to pass the privilege check), and takes a userspace-provided\n   firmware name.\n   (But I think to reach this case, you need to have CAP_NET_ADMIN over a\n   network namespace that a special kind of ethernet device is mapped into,\n   so I think this is not a viable attack path in practice.)\n\nFix it by rejecting any firmware names containing \"..\" path components.\n\nFor what it\u0027s worth, I went looking and haven\u0027t found any USB device\ndrivers that use the firmware loader dangerously."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The most viable attacker-triggerable path is the local ETHTOOL_MSG_MODULE_FW_FLASH_ACT generic-netlink command, which passes a fully attacker-controlled filename string into request_firmware_direct(); the device-side paths (lpfc VPD, nfp hwinfo) would only be Physical, so Local is the higher-severity reachable vector.\nAC:L - There is no race, no memory-layout dependency, and no probabilistic element \u2014 the attacker supplies the \"..\" path directly and traversal succeeds deterministically on the first attempt.\nPR:L - The ethtool op is marked GENL_UNS_ADMIN_PERM, meaning CAP_NET_ADMIN inside a user namespace satisfies the check, which per kernel scoring practice is an unprivileged local user; the alternative lpfc path needs no host credentials at all, only a device supplying a malicious VPD ModelName string.\nUI:N - The attacker sends the netlink request itself and the firmware load happens synchronously in that syscall; no victim action is required (and on the lpfc path the load fires automatically from the driver\u0027s probe/init routine).\nS:U - The vulnerable component and the impacted resources are both the host kernel and its filesystem \u2014 there is no VM, hypervisor, or IOMMU boundary crossed, so this is standard in-kernel impact.\nC:H - _request_firmware() reads the target with kernel credentials (override_creds(prepare_kernel_cred(\u0026init_task))) resolved against init\u0027s mount namespace, so traversal yields an arbitrary root-privileged read of any file on the host (/etc/shadow, TLS/SSH private keys), and the contents are then shipped into device flash where an attacker controlling the HBA or transceiver can retrieve them.\nI:H - The traversal breaks the firmware loader\u0027s guarantee that images come only from root-owned /lib/firmware, letting the attacker redirect the load to a file they wrote themselves and have that unvalidated content flashed into device firmware (lpfc_wr_object / CMIS module update) as well as parsed by driver firmware-parsing code that trusts its input.\nA:H - Writing non-firmware or attacker-authored content into an HBA\u0027s or optical module\u0027s flash can permanently brick the adapter, driver firmware parsers readily oops on arbitrary non-firmware data, and kernel_read_file() vmalloc()s the entire target file (up to INT_MAX) so pointing at a multi-gigabyte file drives the machine into memory exhaustion."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:39:52.866Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d1768e5535d3ded59f888637016e6f821f4e069f"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b1ca33ebd05b3acef5b976c04e5e791af93ce1b"
        },
        {
          "url": "https://git.kernel.org/stable/c/c30558e6c5c9ad6c86459d9acce1520ceeab9ea6"
        },
        {
          "url": "https://git.kernel.org/stable/c/a77fc4acfd49fc6076e565445b2bc5fdc3244da4"
        },
        {
          "url": "https://git.kernel.org/stable/c/3d2411f4edcb649eaf232160db459bb4770b5251"
        },
        {
          "url": "https://git.kernel.org/stable/c/7420c1bf7fc784e587b87329cc6dfa3dca537aa4"
        },
        {
          "url": "https://git.kernel.org/stable/c/28f1cd94d3f1092728fb775a0fe26c5f1ac2ebeb"
        },
        {
          "url": "https://git.kernel.org/stable/c/6c4e13fdfcab34811c3143a0a03c05fec4e870ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0e5311aa8022107d63c54e2f03684ec097d1394"
        }
      ],
      "title": "firmware_loader: Block path traversal",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-47742",
    "datePublished": "2024-10-21T12:14:10.499Z",
    "dateReserved": "2024-09-30T16:00:12.959Z",
    "dateUpdated": "2026-08-05T11:39:52.866Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-47742",
      "date": "2026-08-07",
      "epss": "0.00289",
      "percentile": "0.21119"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.7\", \"versionEndExcluding\": \"5.10.227\", \"matchCriteriaId\": \"3B73A13A-D7BE-4035-BEF2-2821D9D5CB6D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.11\", \"versionEndExcluding\": \"5.15.168\", \"matchCriteriaId\": \"4D51C05D-455B-4D8D-89E7-A58E140B864C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"6.1.113\", \"matchCriteriaId\": \"D01BD22E-ACD1-4618-9D01-6116570BE1EE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.54\", \"matchCriteriaId\": \"D448821D-C085-4CAF-88FA-2DDE7BE21976\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.10.13\", \"matchCriteriaId\": \"CE94BB8D-B0AB-4563-9ED7-A12122B56EBE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.11\", \"versionEndExcluding\": \"6.11.2\", \"matchCriteriaId\": \"AB755D26-97F4-43B6-8604-CD076811E181\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfirmware_loader: Block path traversal\\n\\nMost firmware names are hardcoded strings, or are constructed from fairly\\nconstrained format strings where the dynamic parts are just some hex\\nnumbers or such.\\n\\nHowever, there are a couple codepaths in the kernel where firmware file\\nnames contain string components that are passed through from a device or\\nsemi-privileged userspace; the ones I could find (not counting interfaces\\nthat require root privileges) are:\\n\\n - lpfc_sli4_request_firmware_update() seems to construct the firmware\\n   filename from \\\"ModelName\\\", a string that was previously parsed out of\\n   some descriptor (\\\"Vital Product Data\\\") in lpfc_fill_vpd()\\n - nfp_net_fw_find() seems to construct a firmware filename from a model\\n   name coming from nfp_hwinfo_lookup(pf-\u003ehwinfo, \\\"nffw.partno\\\"), which I\\n   think parses some descriptor that was read from the device.\\n   (But this case likely isn\u0027t exploitable because the format string looks\\n   like \\\"netronome/nic_%s\\\", and there shouldn\u0027t be any *folders* starting\\n   with \\\"netronome/nic_\\\". The previous case was different because there,\\n   the \\\"%s\\\" is *at the start* of the format string.)\\n - module_flash_fw_schedule() is reachable from the\\n   ETHTOOL_MSG_MODULE_FW_FLASH_ACT netlink command, which is marked as\\n   GENL_UNS_ADMIN_PERM (meaning CAP_NET_ADMIN inside a user namespace is\\n   enough to pass the privilege check), and takes a userspace-provided\\n   firmware name.\\n   (But I think to reach this case, you need to have CAP_NET_ADMIN over a\\n   network namespace that a special kind of ethernet device is mapped into,\\n   so I think this is not a viable attack path in practice.)\\n\\nFix it by rejecting any firmware names containing \\\"..\\\" path components.\\n\\nFor what it\u0027s worth, I went looking and haven\u0027t found any USB device\\ndrivers that use the firmware loader dangerously.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: firmware_loader: Block path traversal La mayor\\u00eda de los nombres de firmware son cadenas codificadas o se construyen a partir de cadenas de formato bastante restringidas donde las partes din\\u00e1micas son solo algunos n\\u00fameros hexadecimales o algo as\\u00ed. Sin embargo, hay un par de rutas de c\\u00f3digo en el kernel donde los nombres de archivo de firmware contienen componentes de cadena que se pasan desde un dispositivo o un espacio de usuario semiprivilegiado; los que pude encontrar (sin contar las interfaces que requieren privilegios de root) son: - lpfc_sli4_request_firmware_update() parece construir el nombre de archivo de firmware a partir de \\\"ModelName\\\", una cadena que se analiz\\u00f3 previamente a partir de alg\\u00fan descriptor (\\\"Vital Product Data\\\") en lpfc_fill_vpd() - nfp_net_fw_find() parece construir un nombre de archivo de firmware a partir de un nombre de modelo que proviene de nfp_hwinfo_lookup(pf-\u0026gt;hwinfo, \\\"nffw.partno\\\"), que creo que analiza alg\\u00fan descriptor que se ley\\u00f3 desde el dispositivo. (Pero este caso probablemente no sea explotable porque la cadena de formato se parece a \\\"netronome/nic_%s\\\", y no deber\\u00eda haber ninguna *carpeta* que comience con \\\"netronome/nic_\\\". El caso anterior era diferente porque all\\u00ed, el \\\"%s\\\" est\\u00e1 *al comienzo* de la cadena de formato). - module_flash_fw_schedule() es accesible desde el comando netlink ETHTOOL_MSG_MODULE_FW_FLASH_ACT, que est\\u00e1 marcado como GENL_UNS_ADMIN_PERM (lo que significa que CAP_NET_ADMIN dentro de un espacio de nombres de usuario es suficiente para pasar la verificaci\\u00f3n de privilegios), y toma un nombre de firmware provisto por el espacio de usuario. (Pero creo que para llegar a este caso, necesita tener CAP_NET_ADMIN sobre un espacio de nombres de red en el que se asigna un tipo especial de dispositivo Ethernet, por lo que creo que esta no es una ruta de ataque viable en la pr\\u00e1ctica). Arr\\u00e9glelo rechazando cualquier nombre de firmware que contenga componentes de ruta \\\"..\\\" Por si sirve de algo, he buscado y no he encontrado ning\\u00fan controlador de dispositivo USB que utilice el cargador de firmware de forma peligrosa.\"}]",
      "id": "CVE-2024-47742",
      "lastModified": "2024-11-08T16:15:27.613",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-10-21T13:15:04.297",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/28f1cd94d3f1092728fb775a0fe26c5f1ac2ebeb\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/3d2411f4edcb649eaf232160db459bb4770b5251\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/6c4e13fdfcab34811c3143a0a03c05fec4e870ec\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/7420c1bf7fc784e587b87329cc6dfa3dca537aa4\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/9b1ca33ebd05b3acef5b976c04e5e791af93ce1b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/a77fc4acfd49fc6076e565445b2bc5fdc3244da4\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/c30558e6c5c9ad6c86459d9acce1520ceeab9ea6\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/d1768e5535d3ded59f888637016e6f821f4e069f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/f0e5311aa8022107d63c54e2f03684ec097d1394\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-22\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T01:54:11.000Z",
      "cve": "CVE-2024-47742",
      "id": "msrc_CVE-2024-47742",
      "initial_release_date": "2024-10-01T07:00:00.000Z",
      "product_status:fixed": "5",
      "product_status:known_affected": "5",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "firmware_loader: Block path traversal",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-47742.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-47742\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T13:15:04.297\",\"lastModified\":\"2026-08-04T11:20:47.217\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfirmware_loader: Block path traversal\\n\\nMost firmware names are hardcoded strings, or are constructed from fairly\\nconstrained format strings where the dynamic parts are just some hex\\nnumbers or such.\\n\\nHowever, there are a couple codepaths in the kernel where firmware file\\nnames contain string components that are passed through from a device or\\nsemi-privileged userspace; the ones I could find (not counting interfaces\\nthat require root privileges) are:\\n\\n - lpfc_sli4_request_firmware_update() seems to construct the firmware\\n   filename from \\\"ModelName\\\", a string that was previously parsed out of\\n   some descriptor (\\\"Vital Product Data\\\") in lpfc_fill_vpd()\\n - nfp_net_fw_find() seems to construct a firmware filename from a model\\n   name coming from nfp_hwinfo_lookup(pf-\u003ehwinfo, \\\"nffw.partno\\\"), which I\\n   think parses some descriptor that was read from the device.\\n   (But this case likely isn\u0027t exploitable because the format string looks\\n   like \\\"netronome/nic_%s\\\", and there shouldn\u0027t be any *folders* starting\\n   with \\\"netronome/nic_\\\". The previous case was different because there,\\n   the \\\"%s\\\" is *at the start* of the format string.)\\n - module_flash_fw_schedule() is reachable from the\\n   ETHTOOL_MSG_MODULE_FW_FLASH_ACT netlink command, which is marked as\\n   GENL_UNS_ADMIN_PERM (meaning CAP_NET_ADMIN inside a user namespace is\\n   enough to pass the privilege check), and takes a userspace-provided\\n   firmware name.\\n   (But I think to reach this case, you need to have CAP_NET_ADMIN over a\\n   network namespace that a special kind of ethernet device is mapped into,\\n   so I think this is not a viable attack path in practice.)\\n\\nFix it by rejecting any firmware names containing \\\"..\\\" path components.\\n\\nFor what it\u0027s worth, I went looking and haven\u0027t found any USB device\\ndrivers that use the firmware loader dangerously.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: firmware_loader: Block path traversal La mayor\u00eda de los nombres de firmware son cadenas codificadas o se construyen a partir de cadenas de formato bastante restringidas donde las partes din\u00e1micas son solo algunos n\u00fameros hexadecimales o algo as\u00ed. Sin embargo, hay un par de rutas de c\u00f3digo en el kernel donde los nombres de archivo de firmware contienen componentes de cadena que se pasan desde un dispositivo o un espacio de usuario semiprivilegiado; los que pude encontrar (sin contar las interfaces que requieren privilegios de root) son: - lpfc_sli4_request_firmware_update() parece construir el nombre de archivo de firmware a partir de \\\"ModelName\\\", una cadena que se analiz\u00f3 previamente a partir de alg\u00fan descriptor (\\\"Vital Product Data\\\") en lpfc_fill_vpd() - nfp_net_fw_find() parece construir un nombre de archivo de firmware a partir de un nombre de modelo que proviene de nfp_hwinfo_lookup(pf-\u0026gt;hwinfo, \\\"nffw.partno\\\"), que creo que analiza alg\u00fan descriptor que se ley\u00f3 desde el dispositivo. (Pero este caso probablemente no sea explotable porque la cadena de formato se parece a \\\"netronome/nic_%s\\\", y no deber\u00eda haber ninguna *carpeta* que comience con \\\"netronome/nic_\\\". El caso anterior era diferente porque all\u00ed, el \\\"%s\\\" est\u00e1 *al comienzo* de la cadena de formato). - module_flash_fw_schedule() es accesible desde el comando netlink ETHTOOL_MSG_MODULE_FW_FLASH_ACT, que est\u00e1 marcado como GENL_UNS_ADMIN_PERM (lo que significa que CAP_NET_ADMIN dentro de un espacio de nombres de usuario es suficiente para pasar la verificaci\u00f3n de privilegios), y toma un nombre de firmware provisto por el espacio de usuario. (Pero creo que para llegar a este caso, necesita tener CAP_NET_ADMIN sobre un espacio de nombres de red en el que se asigna un tipo especial de dispositivo Ethernet, por lo que creo que esta no es una ruta de ataque viable en la pr\u00e1ctica). Arr\u00e9glelo rechazando cualquier nombre de firmware que contenga componentes de ruta \\\"..\\\" Por si sirve de algo, he buscado y no he encontrado ning\u00fan controlador de dispositivo USB que utilice el cargador de firmware de forma peligrosa.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/base/firmware_loader/main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"abb139e75c2cdbb955e840d6331cb5863e409d0e\",\"lessThan\":\"d1768e5535d3ded59f888637016e6f821f4e069f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"abb139e75c2cdbb955e840d6331cb5863e409d0e\",\"lessThan\":\"9b1ca33ebd05b3acef5b976c04e5e791af93ce1b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"abb139e75c2cdbb955e840d6331cb5863e409d0e\",\"lessThan\":\"c30558e6c5c9ad6c86459d9acce1520ceeab9ea6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"abb139e75c2cdbb955e840d6331cb5863e409d0e\",\"lessThan\":\"a77fc4acfd49fc6076e565445b2bc5fdc3244da4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"abb139e75c2cdbb955e840d6331cb5863e409d0e\",\"lessThan\":\"3d2411f4edcb649eaf232160db459bb4770b5251\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"abb139e75c2cdbb955e840d6331cb5863e409d0e\",\"lessThan\":\"7420c1bf7fc784e587b87329cc6dfa3dca537aa4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"abb139e75c2cdbb955e840d6331cb5863e409d0e\",\"lessThan\":\"28f1cd94d3f1092728fb775a0fe26c5f1ac2ebeb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"abb139e75c2cdbb955e840d6331cb5863e409d0e\",\"lessThan\":\"6c4e13fdfcab34811c3143a0a03c05fec4e870ec\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"abb139e75c2cdbb955e840d6331cb5863e409d0e\",\"lessThan\":\"f0e5311aa8022107d63c54e2f03684ec097d1394\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/base/firmware_loader/main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.323\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.285\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.227\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.168\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.113\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.54\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.13\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.2\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-21T12:59:04.060717Z\",\"id\":\"CVE-2024-47742\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.7\",\"versionEndExcluding\":\"4.19.323\",\"matchCriteriaId\":\"02E209D0-429E-482D-972E-CBF56B5FB05A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.285\",\"matchCriteriaId\":\"B5A89369-320F-47FC-8695-56F61F87E4C0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.227\",\"matchCriteriaId\":\"795A3EE6-0CAB-4409-A903-151C94ACECC0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.168\",\"matchCriteriaId\":\"4D51C05D-455B-4D8D-89E7-A58E140B864C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.113\",\"matchCriteriaId\":\"D01BD22E-ACD1-4618-9D01-6116570BE1EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.54\",\"matchCriteriaId\":\"D448821D-C085-4CAF-88FA-2DDE7BE21976\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.13\",\"matchCriteriaId\":\"CE94BB8D-B0AB-4563-9ED7-A12122B56EBE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.2\",\"matchCriteriaId\":\"AB755D26-97F4-43B6-8604-CD076811E181\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/28f1cd94d3f1092728fb775a0fe26c5f1ac2ebeb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3d2411f4edcb649eaf232160db459bb4770b5251\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6c4e13fdfcab34811c3143a0a03c05fec4e870ec\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7420c1bf7fc784e587b87329cc6dfa3dca537aa4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9b1ca33ebd05b3acef5b976c04e5e791af93ce1b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a77fc4acfd49fc6076e565445b2bc5fdc3244da4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c30558e6c5c9ad6c86459d9acce1520ceeab9ea6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d1768e5535d3ded59f888637016e6f821f4e069f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f0e5311aa8022107d63c54e2f03684ec097d1394\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T17:57:40+00:00",
      "cve": "CVE-2024-47742",
      "id": "CVE-2024-47742",
      "initial_release_date": "2024-10-21T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: firmware_loader: Block path traversal",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-47742.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T01:34:18Z",
      "cve": "CVE-2024-47742",
      "id": "CVE-2024-47742",
      "initial_release_date": "2024-10-21T15:46:24Z",
      "product_status:known_affected": "584",
      "product_status:known_not_affected": "59",
      "product_status:recommended": "681",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-47742",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-47742.json",
      "version": "73"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:21:38.407Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-47742\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-21T12:59:04.060717Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-21T12:59:07.169Z\"}}], \"cna\": {\"title\": \"firmware_loader: Block path traversal\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"abb139e75c2cdbb955e840d6331cb5863e409d0e\", \"lessThan\": \"d1768e5535d3ded59f888637016e6f821f4e069f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"abb139e75c2cdbb955e840d6331cb5863e409d0e\", \"lessThan\": \"9b1ca33ebd05b3acef5b976c04e5e791af93ce1b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"abb139e75c2cdbb955e840d6331cb5863e409d0e\", \"lessThan\": \"c30558e6c5c9ad6c86459d9acce1520ceeab9ea6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"abb139e75c2cdbb955e840d6331cb5863e409d0e\", \"lessThan\": \"a77fc4acfd49fc6076e565445b2bc5fdc3244da4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"abb139e75c2cdbb955e840d6331cb5863e409d0e\", \"lessThan\": \"3d2411f4edcb649eaf232160db459bb4770b5251\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"abb139e75c2cdbb955e840d6331cb5863e409d0e\", \"lessThan\": \"7420c1bf7fc784e587b87329cc6dfa3dca537aa4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"abb139e75c2cdbb955e840d6331cb5863e409d0e\", \"lessThan\": \"28f1cd94d3f1092728fb775a0fe26c5f1ac2ebeb\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"abb139e75c2cdbb955e840d6331cb5863e409d0e\", \"lessThan\": \"6c4e13fdfcab34811c3143a0a03c05fec4e870ec\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"abb139e75c2cdbb955e840d6331cb5863e409d0e\", \"lessThan\": \"f0e5311aa8022107d63c54e2f03684ec097d1394\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/base/firmware_loader/main.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.323\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.285\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.227\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.168\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.113\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.54\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/base/firmware_loader/main.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d1768e5535d3ded59f888637016e6f821f4e069f\"}, {\"url\": \"https://git.kernel.org/stable/c/9b1ca33ebd05b3acef5b976c04e5e791af93ce1b\"}, {\"url\": \"https://git.kernel.org/stable/c/c30558e6c5c9ad6c86459d9acce1520ceeab9ea6\"}, {\"url\": \"https://git.kernel.org/stable/c/a77fc4acfd49fc6076e565445b2bc5fdc3244da4\"}, {\"url\": \"https://git.kernel.org/stable/c/3d2411f4edcb649eaf232160db459bb4770b5251\"}, {\"url\": \"https://git.kernel.org/stable/c/7420c1bf7fc784e587b87329cc6dfa3dca537aa4\"}, {\"url\": \"https://git.kernel.org/stable/c/28f1cd94d3f1092728fb775a0fe26c5f1ac2ebeb\"}, {\"url\": \"https://git.kernel.org/stable/c/6c4e13fdfcab34811c3143a0a03c05fec4e870ec\"}, {\"url\": \"https://git.kernel.org/stable/c/f0e5311aa8022107d63c54e2f03684ec097d1394\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfirmware_loader: Block path traversal\\n\\nMost firmware names are hardcoded strings, or are constructed from fairly\\nconstrained format strings where the dynamic parts are just some hex\\nnumbers or such.\\n\\nHowever, there are a couple codepaths in the kernel where firmware file\\nnames contain string components that are passed through from a device or\\nsemi-privileged userspace; the ones I could find (not counting interfaces\\nthat require root privileges) are:\\n\\n - lpfc_sli4_request_firmware_update() seems to construct the firmware\\n   filename from \\\"ModelName\\\", a string that was previously parsed out of\\n   some descriptor (\\\"Vital Product Data\\\") in lpfc_fill_vpd()\\n - nfp_net_fw_find() seems to construct a firmware filename from a model\\n   name coming from nfp_hwinfo_lookup(pf-\u003ehwinfo, \\\"nffw.partno\\\"), which I\\n   think parses some descriptor that was read from the device.\\n   (But this case likely isn\u0027t exploitable because the format string looks\\n   like \\\"netronome/nic_%s\\\", and there shouldn\u0027t be any *folders* starting\\n   with \\\"netronome/nic_\\\". The previous case was different because there,\\n   the \\\"%s\\\" is *at the start* of the format string.)\\n - module_flash_fw_schedule() is reachable from the\\n   ETHTOOL_MSG_MODULE_FW_FLASH_ACT netlink command, which is marked as\\n   GENL_UNS_ADMIN_PERM (meaning CAP_NET_ADMIN inside a user namespace is\\n   enough to pass the privilege check), and takes a userspace-provided\\n   firmware name.\\n   (But I think to reach this case, you need to have CAP_NET_ADMIN over a\\n   network namespace that a special kind of ethernet device is mapped into,\\n   so I think this is not a viable attack path in practice.)\\n\\nFix it by rejecting any firmware names containing \\\"..\\\" path components.\\n\\nFor what it\u0027s worth, I went looking and haven\u0027t found any USB device\\ndrivers that use the firmware loader dangerously.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.323\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.285\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.227\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.168\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.113\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.54\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.13\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.2\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"3.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:39:52.617Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-47742\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:39:52.617Z\", \"dateReserved\": \"2024-09-30T16:00:12.959Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T12:14:10.499Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.