Threats tagged 'ghsa-q4p6-5cf2-247q'

CVE-2024-47742 is a high-severity vulnerability in the Linux kernel's firmware loader that allows path traversal attacks. The flaw arises because certain firmware file names are constructed from strings that can include user-controlled or device-derived components without proper sanitization. This could allow an attacker with limited privileges to specify firmware file paths containing ".." components, potentially leading to unauthorized file access or modification. The vulnerability is mitigated by rejecting firmware names containing ".." path components.