Problem Description:
CVE-2024-45287 is a vulnerability that affects both the kernel
and userland. A malicious value of size in a structure of packed
libnv can cause an integer overflow, leading to the allocation of
a smaller buffer than required for the parsed data.
CVE-2024-45288 is a vulnerability that affects both the kernel and
userland. A missing null-termination character in the last element
of an nvlist array string can lead to writing outside the allocated
buffer.
Impact:
It is possible for an attacker to overwrite portions of memory
(in userland or the kernel) as the allocated buffer might be smaller
than the data received from a malicious process. This vulnerability
could result in privilege escalation or cause a system panic.