{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-13T00:44:25.228","vulnerabilities":[{"cve":{"id":"CVE-2024-26706","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2024-04-03T15:15:53.293","lastModified":"2025-03-17T15:36:31.360","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nparisc: Fix random data corruption from exception handler\n\nThe current exception handler implementation, which assists when accessing\nuser space memory, may exhibit random data corruption if the compiler decides\nto use a different register than the specified register %r29 (defined in\nASM_EXCEPTIONTABLE_REG) for the error code. If the compiler choose another\nregister, the fault handler will nevertheless store -EFAULT into %r29 and thus\ntrash whatever this register is used for.\nLooking at the assembly I found that this happens sometimes in emulate_ldd().\n\nTo solve the issue, the easiest solution would be if it somehow is\npossible to tell the fault handler which register is used to hold the error\ncode. Using %0 or %1 in the inline assembly is not posssible as it will show\nup as e.g. %r29 (with the \"%r\" prefix), which the GNU assembler can not\nconvert to an integer.\n\nThis patch takes another, better and more flexible approach:\nWe extend the __ex_table (which is out of the execution path) by one 32-word.\nIn this word we tell the compiler to insert the assembler instruction\n\"or %r0,%r0,%reg\", where %reg references the register which the compiler\nchoosed for the error return code.\nIn case of an access failure, the fault handler finds the __ex_table entry and\ncan examine the opcode. The used register is encoded in the lowest 5 bits, and\nthe fault handler can then store -EFAULT into this register.\n\nSince we extend the __ex_table to 3 words we can't use the BUILDTIME_TABLE_SORT\nconfig option any longer."},{"lang":"es","value":"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: parisc: corrige la corrupción aleatoria de datos del controlador de excepciones La implementación actual del controlador de excepciones, que ayuda al acceder a la memoria del espacio del usuario, puede exhibir corrupción aleatoria de datos si el compilador decide usar un registro diferente al el registro especificado %r29 (definido en ASM_EXCEPTIONTABLE_REG) para el código de error. Si el compilador elige otro registro, el manejador de fallas almacenará -EFAULT en %r29 y, por lo tanto, eliminará cualquier cosa para la que se utilice este registro. Al observar el ensamblaje, encontré que esto sucede a veces en emulate_ldd(). Para resolver el problema, la solución más sencilla sería si de alguna manera fuera posible decirle al manejador de fallas qué registro se utiliza para contener el código de error. No es posible usar %0 o %1 en el ensamblador en línea ya que aparecerá, por ejemplo, como %r29 (con el prefijo \"%r\"), que el ensamblador GNU no puede convertir a un número entero. Este parche adopta otro enfoque mejor y más flexible: ampliamos el __ex_table (que está fuera de la ruta de ejecución) en 32 palabras. En esta palabra le decimos al compilador que inserte la instrucción ensambladora \"o %r0,%r0,%reg\", donde %reg hace referencia al registro que el compilador eligió para el código de retorno de error. En caso de un error de acceso, el controlador de fallas encuentra la entrada __ex_table y puede examinar el código de operación. El registro utilizado está codificado en los 5 bits más bajos y el manejador de fallas puede almacenar -EFAULT en este registro. Dado que ampliamos __ex_table a 3 palabras, ya no podemos usar la opción de configuración BUILDTIME_TABLE_SORT."}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.79","matchCriteriaId":"0CD66F01-9687-41BC-ADEE-C4E51121167A"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.6.18","matchCriteriaId":"BD961E49-FEDA-47CF-BF23-4D2BD942B4E0"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.7.6","matchCriteriaId":"C6D6A5C8-7308-42A9-8A72-ABF3DEA4BB82"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*","matchCriteriaId":"B9F4EA73-0894-400F-A490-3A397AB7A517"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*","matchCriteriaId":"056BD938-0A27-4569-B391-30578B309EE3"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/23027309b099ffc4efca5477009a11dccbdae592","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/8b1d72395635af45410b66cc4c4ab37a12c4a831","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/ce31d79aa1f13a2345791f84935281a2c194e003","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/fa69a8063f8b27f3c7434a0d4f464a76a62f24d2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/23027309b099ffc4efca5477009a11dccbdae592","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/8b1d72395635af45410b66cc4c4ab37a12c4a831","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/ce31d79aa1f13a2345791f84935281a2c194e003","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/fa69a8063f8b27f3c7434a0d4f464a76a62f24d2","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]}]}}]}