CVE-2024-36010

igb: Fix string truncation warnings in igb_set_fw_version

State
Published
Severity
Not scored
Published
May 22, 2024
Updated
May 11, 2026
Reserved
May 17, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

igb: Fix string truncation warnings in igb_set_fw_version

Commit 1978d3ead82c ("intel: fix string truncation warnings") fixes '-Wformat-truncation=' warnings in igb_main.c by using kasprintf.

drivers/net/ethernet/intel/igb/igb_main.c:3092:53: warning:‘%d’ directive output may be truncated writing between 1 and 5 bytes into a region of size between 1 and 13 [-Wformat-truncation=] 3092 | "%d.%d, 0x%08x, %d.%d.%d", | ^~ drivers/net/ethernet/intel/igb/igb_main.c:3092:34: note:directive argument in the range [0, 65535] 3092 | "%d.%d, 0x%08x, %d.%d.%d", | ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/intel/igb/igb_main.c:3092:34: note:directive argument in the range [0, 65535] drivers/net/ethernet/intel/igb/igb_main.c:3090:25: note:‘snprintf’ output between 23 and 43 bytes into a destination of size 32

kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure.

Fix this warning by using a larger space for adapter->fw_version, and then fall back and continue to use snprintf.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 1978d3ead82c8e39d739dd4e19b1ea7bf923dfb4 to before c56d055893cbe97848611855d1c97d0ab171ecccAffected
LinuxLinux
  • 6.7Affected
  • before 6.7Not affected
  • 6.8 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.