Bug 2301917 - CVE-2024-38986 libarrow: From NVD collector [fedora-all]
Summary: CVE-2024-38986 libarrow: From NVD collector [fedora-all]
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: libarrow
Version: 40
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: ---
Assignee: Kaleb KEITHLEY
QA Contact:
URL:
Whiteboard: {"flaws": ["d76e876c-fe8d-47fb-a385-4...
Depends On:
Blocks: CVE-2024-38986
TreeView+ depends on / blocked
 
Reported: 2024-07-31 07:50 UTC by Rohit Keshri
Modified: 2024-08-26 13:53 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2024-08-01 11:27:32 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Rohit Keshri 2024-07-31 07:50:59 UTC
More information about this security flaw is available in the following bug:

https://bugzilla.redhat.com/show_bug.cgi?id=2301820

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Comment 1 Kaleb KEITHLEY 2024-07-31 12:53:28 UTC
There's not enough context here for me to tell anything.

How does an integer overflow in a kernel driver have any relationship to Apache Arrow libraries running in user space?

Comment 2 Ben Beasley 2024-07-31 14:11:29 UTC
Looking at https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-38986, the CVE is not in the kernel but in https://github.com/75lb/deep-merge combined with https://lodash.com/ . I know the CVE bug-filing scripts are frustratingly trigger-happy, and will file bugs related to anything they can find in a package.json or package-lock.json in your package’s source tree, even example code that isn’t installed. You can try grepping the source tree for "deep-merge" and "lodash" to make an educated guess at what’s triggering the bug-filing script. If you don’t ship any JavaScript in any of the subpackages, this is pretty much guaranteed to be NOTABUG. If you do ship JavaScript, maybe it merits investigation.

(This is just a drive-by helpful comment. I have no influence over the filing of these bugs.)

Comment 3 Kaleb KEITHLEY 2024-08-01 11:27:32 UTC
No javascript

Comment 4 Rohit Keshri 2024-08-26 13:53:50 UTC
(In reply to Kaleb KEITHLEY from comment #1)
> There's not enough context here for me to tell anything.
> 
> How does an integer overflow in a kernel driver have any relationship to
> Apache Arrow libraries running in user space?

Thanks for review,


Note You need to log in before you can comment on or make changes to this bug.