Problem Description:

CVE-2024-45287 is a vulnerability that affects both the kernel and userland. A malicious value of size in a structure of packed libnv can cause an integer overflow, leading to the allocation of a smaller buffer than required for the parsed data.

CVE-2024-45288 is a vulnerability that affects both the kernel and userland. A missing null-termination character in the last element of an nvlist array string can lead to writing outside the allocated buffer.

Impact:

It is possible for an attacker to overwrite portions of memory (in userland or the kernel) as the allocated buffer might be smaller than the data received from a malicious process. This vulnerability could result in privilege escalation or cause a system panic.

>= 14.1 lt 14.1_4

>= 14.0 lt 14.0_10

>= 13.3 lt 13.3_6

>= 14.1 lt 14.1_4

>= 14.0 lt 14.0_10

>= 13.3 lt 13.3_6