CVE-2024-38599: linux kernel from 2.6.18 (inclusive), before 4.19.316 (exclusive), from 4.20 (inclusive), before 5.4.278 (exclusive)…

Affected technology

linux kernel · from 2.6.18 (inclusive), before 4.19.316 (exclusive)
linux

linux kernel · from 4.20 (inclusive), before 5.4.278 (exclusive)
linux

linux kernel · from 5.5 (inclusive), before 5.10.219 (exclusive)
linux

linux kernel · from 5.11 (inclusive), before 5.15.161 (exclusive)
linux

linux kernel · from 5.16 (inclusive), before 6.1.93 (exclusive)
linux

linux kernel · from 6.2 (inclusive), before 6.6.33 (exclusive)
linux

linux kernel · from 6.7 (inclusive), before 6.8.12 (exclusive)
linux

linux kernel · from 6.9 (inclusive), before 6.9.3 (exclusive)
linux

Linux · aa98d7cf59b5b0764d3502662053489585faf2fe to before 2904e1d9b64f72d291095e3cbb31634f08788b11, aa98d7cf59b5b0764d3502662053489585faf2fe to before 526235dffcac74c7823ed504dfac4f88d84ba5df, aa98d7cf59b5b0764d3502662053489585faf2fe to before f0eea095ce8c959b86e1e57fe36ca4fea5ae54f8, aa98d7cf59b5b0764d3502662053489585faf2fe to before a1d21bcd78cf4a4353e1e835789429c6b76aca8b, aa98d7cf59b5b0764d3502662053489585faf2fe to before f06969df2e40ab1dc8f4364a5de967830c74a098, aa98d7cf59b5b0764d3502662053489585faf2fe to before af82d8d2179b7277ad627c39e7e0778f1c86ccdb, aa98d7cf59b5b0764d3502662053489585faf2fe to before 8d431391320c5c5398ff966fb3a95e68a7def275, aa98d7cf59b5b0764d3502662053489585faf2fe to before 978a12c91b38bf1a213e567f3c20e2beef215f07, aa98d7cf59b5b0764d3502662053489585faf2fe to before c6854e5a267c28300ff045480b5a7ee7f6f1d913
Linux

Linux · 2.6.18
Linux

SIMATIC S7-1500 TM MFP - GNU/Linux subsystem · 0 to before V1.1.1
Siemens

Component: Not specified by the source
File: fs/jffs2/xattr.c

Attack conditions (Source advisory, CVSS 3.1): Local · Low privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Local · Low privileges required · No user interaction required

What an attacker can do

Source advisory’s CVSS 3.1 assessment (base score 7.8/10) rates confidentiality, integrity and availability impact as high. NVD’s CVSS 3.1 assessment (base score 7.1/10) rates confidentiality and availability impact as high; integrity impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.