CVE-2024-45288

Description

A missing null-termination character in the last element of an nvlist array string can lead to writing outside the allocated buffer.

Reserved 2024-08-26 | Published 2024-09-05 | Updated 2024-09-20 | Assigner freebsd

Problem types

CWE-170: Improper Null Termination

CWE-787 Out-of-bounds Write

Product status

Default status
unknown

14.1-RELEASE before p4
affected

14.0-RELEASE before p10
affected

13.3-RELEASE before p6
affected

Credits

Synacktiv finder

References

security.freebsd.org/advisories/FreeBSD-SA-24:09.libnv.asc vendor-advisory

cve.org (CVE-2024-45288)

nvd.nist.gov (CVE-2024-45288)

Download JSON