cve/2024/CVE-2024-43845.md

### [CVE-2024-43845](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-43845)
![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=6.3%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=626860c470ff88e5f7f22a282efd1bfe953a1b54%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=e9109a92d2a95889498bed3719cd2318892171a2%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue)

### Description

In the Linux kernel, the following vulnerability has been resolved:udf: Fix bogus checksum computation in udf_rename()Syzbot reports uninitialized memory access in udf_rename() when updatingchecksum of '..' directory entry of a moved directory. This is indeedtrue as we pass on-stack diriter.fi to the udf_update_tag() and becausethat has only struct fileIdentDesc included in it and not the impUse orname fields, the checksumming function is going to checksum random stackcontents beyond the end of the structure. This is actually harmlessbecause the following udf_fiiter_write_fi() will recompute the checksumfrom on-disk buffers where everything is properly included. So all thatis needed is just removing the bogus calculation.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/fkie-cad/nvd-json-data-feeds