CVE-2024-49860

In the Linux kernel, the following vulnerability has been resolved: ACPI: sysfs: validate return type of _STR method Only buffer objects are valid return values of _STR. If something else is returned description_show() will access invalid memory.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/0cdfb9178a3bba843c95c2117c82c15f1a64b9ce	Patch
https://git.kernel.org/stable/c/2364b6af90c6b6d8a4783e0d3481ca80af699554
https://git.kernel.org/stable/c/4b081991c4363e072e1748efed0bbec8a77daba5	Patch
https://git.kernel.org/stable/c/4bb1e7d027413835b086aed35bc3f0713bc0f72b	Patch
https://git.kernel.org/stable/c/5c8d007c14aefc3f2ddf71e4c40713733dc827be	Patch
https://git.kernel.org/stable/c/92fd5209fc014405f63a7db79802ca4b01dc0c05
https://git.kernel.org/stable/c/f0921ecd4ddc14646bb5511f49db4d7d3b0829f0	Patch
https://git.kernel.org/stable/c/f51e5a88f2e7224858b261546cf6b3037dfb1323	Patch
https://git.kernel.org/stable/c/f51f711d36e61fbb87c67b524fd200e05172668d	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

History

08 Nov 2024, 16:15

Type	Values Removed	Values Added
References		() https://git.kernel.org/stable/c/2364b6af90c6b6d8a4783e0d3481ca80af699554 - () https://git.kernel.org/stable/c/92fd5209fc014405f63a7db79802ca4b01dc0c05 -

23 Oct 2024, 16:44

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.1
First Time		Linux linux Kernel Linux
CWE		CWE-843
CPE		cpe:2.3:o:linux:linux_kernel::::::::
References	~~() https://git.kernel.org/stable/c/0cdfb9178a3bba843c95c2117c82c15f1a64b9ce -~~	() https://git.kernel.org/stable/c/0cdfb9178a3bba843c95c2117c82c15f1a64b9ce - Patch
References	~~() https://git.kernel.org/stable/c/4b081991c4363e072e1748efed0bbec8a77daba5 -~~	() https://git.kernel.org/stable/c/4b081991c4363e072e1748efed0bbec8a77daba5 - Patch
References	~~() https://git.kernel.org/stable/c/4bb1e7d027413835b086aed35bc3f0713bc0f72b -~~	() https://git.kernel.org/stable/c/4bb1e7d027413835b086aed35bc3f0713bc0f72b - Patch
References	~~() https://git.kernel.org/stable/c/5c8d007c14aefc3f2ddf71e4c40713733dc827be -~~	() https://git.kernel.org/stable/c/5c8d007c14aefc3f2ddf71e4c40713733dc827be - Patch
References	~~() https://git.kernel.org/stable/c/f0921ecd4ddc14646bb5511f49db4d7d3b0829f0 -~~	() https://git.kernel.org/stable/c/f0921ecd4ddc14646bb5511f49db4d7d3b0829f0 - Patch
References	~~() https://git.kernel.org/stable/c/f51e5a88f2e7224858b261546cf6b3037dfb1323 -~~	() https://git.kernel.org/stable/c/f51e5a88f2e7224858b261546cf6b3037dfb1323 - Patch
References	~~() https://git.kernel.org/stable/c/f51f711d36e61fbb87c67b524fd200e05172668d -~~	() https://git.kernel.org/stable/c/f51f711d36e61fbb87c67b524fd200e05172668d - Patch
Summary		(es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ACPI: sysfs: validar el tipo de retorno del método _STR. Solo los objetos de búfer son valores de retorno válidos de _STR. Si se devuelve algo diferente, description_show() accederá a memoria no válida.

21 Oct 2024, 13:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-10-21 13:15

Updated : 2024-11-08 16:15

NVD link : CVE-2024-49860

Mitre link : CVE-2024-49860

CVE.ORG link : CVE-2024-49860

JSON object : View

Products Affected

linux

linux_kernel

CWE

CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

7.1 /10