{"id":"DEBIAN-CVE-2024-38578","details":"In the Linux kernel, the following vulnerability has been resolved:  ecryptfs: Fix buffer size for tag 66 packet  The 'TAG 66 Packet Format' description is missing the cipher code and checksum fields that are packed into the message packet. As a result, the buffer allocated for the packet is 3 bytes too small and write_tag_66_packet() will write up to 3 bytes past the end of the buffer.  Fix this by increasing the size of the allocation so the whole packet will always fit in the buffer.  This fixes the below kasan slab-out-of-bounds bug:    BUG: KASAN: slab-out-of-bounds in ecryptfs_generate_key_packet_set+0x7d6/0xde0   Write of size 1 at addr ffff88800afbb2a5 by task touch/181    CPU: 0 PID: 181 Comm: touch Not tainted 6.6.13-gnu #1 4c9534092be820851bb687b82d1f92a426598dc6   Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2/GNU Guix 04/01/2014   Call Trace:    \u003cTASK\u003e    dump_stack_lvl+0x4c/0x70    print_report+0xc5/0x610    ? ecryptfs_generate_key_packet_set+0x7d6/0xde0    ? kasan_complete_mode_report_info+0x44/0x210    ? ecryptfs_generate_key_packet_set+0x7d6/0xde0    kasan_report+0xc2/0x110    ? ecryptfs_generate_key_packet_set+0x7d6/0xde0    __asan_store1+0x62/0x80    ecryptfs_generate_key_packet_set+0x7d6/0xde0    ? __pfx_ecryptfs_generate_key_packet_set+0x10/0x10    ? __alloc_pages+0x2e2/0x540    ? __pfx_ovl_open+0x10/0x10 [overlay 30837f11141636a8e1793533a02e6e2e885dad1d]    ? dentry_open+0x8f/0xd0    ecryptfs_write_metadata+0x30a/0x550    ? __pfx_ecryptfs_write_metadata+0x10/0x10    ? ecryptfs_get_lower_file+0x6b/0x190    ecryptfs_initialize_file+0x77/0x150    ecryptfs_create+0x1c2/0x2f0    path_openat+0x17cf/0x1ba0    ? __pfx_path_openat+0x10/0x10    do_filp_open+0x15e/0x290    ? __pfx_do_filp_open+0x10/0x10    ? __kasan_check_write+0x18/0x30    ? _raw_spin_lock+0x86/0xf0    ? __pfx__raw_spin_lock+0x10/0x10    ? __kasan_check_write+0x18/0x30    ? alloc_fd+0xf4/0x330    do_sys_openat2+0x122/0x160    ? __pfx_do_sys_openat2+0x10/0x10    __x64_sys_openat+0xef/0x170    ? __pfx___x64_sys_openat+0x10/0x10    do_syscall_64+0x60/0xd0    entry_SYSCALL_64_after_hwframe+0x6e/0xd8   RIP: 0033:0x7f00a703fd67   Code: 25 00 00 41 00 3d 00 00 41 00 74 37 64 8b 04 25 18 00 00 00 85 c0 75 5b 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 0f 87 85 00 00 00 48 83 c4 68 5d 41 5c c3 0f 1f   RSP: 002b:00007ffc088e30b0 EFLAGS: 00000246 ORIG_RAX: 0000000000000101   RAX: ffffffffffffffda RBX: 00007ffc088e3368 RCX: 00007f00a703fd67   RDX: 0000000000000941 RSI: 00007ffc088e48d7 RDI: 00000000ffffff9c   RBP: 00007ffc088e48d7 R08: 0000000000000001 R09: 0000000000000000   R10: 00000000000001b6 R11: 0000000000000246 R12: 0000000000000941   R13: 0000000000000000 R14: 00007ffc088e48d7 R15: 00007f00a7180040    \u003c/TASK\u003e    Allocated by task 181:    kasan_save_stack+0x2f/0x60    kasan_set_track+0x29/0x40    kasan_save_alloc_info+0x25/0x40    __kasan_kmalloc+0xc5/0xd0    __kmalloc+0x66/0x160    ecryptfs_generate_key_packet_set+0x6d2/0xde0    ecryptfs_write_metadata+0x30a/0x550    ecryptfs_initialize_file+0x77/0x150    ecryptfs_create+0x1c2/0x2f0    path_openat+0x17cf/0x1ba0    do_filp_open+0x15e/0x290    do_sys_openat2+0x122/0x160    __x64_sys_openat+0xef/0x170    do_syscall_64+0x60/0xd0    entry_SYSCALL_64_after_hwframe+0x6e/0xd8","modified":"2026-09-15T09:02:56.976632220Z","published":"2024-06-19T14:15:17.870Z","upstream":["CVE-2024-38578"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2024-38578"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.94-1"}]}],"versions":["6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1~bpo11+1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-38578.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.12-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-38578.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.12-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-38578.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}