CVE-2024-45021

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-45021
In the Linux kernel, the following vulnerability has been resolved: memcg_write_event_control(): fix a user-triggerable oops we are *not* guaranteed that anything past the terminating NUL is mapped (let alone initialized with anything sane).

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/046667c4d3196938e992fba0dfcde570aa85cd0e Patch
https://git.kernel.org/stable/c/0fbe2a72e853a1052abe9bc2b7df8ddb102da227 Patch
https://git.kernel.org/stable/c/1b37ec85ad95b612307627758c6018cd9d92cca8 Patch
https://git.kernel.org/stable/c/21b578f1d599edb87462f11113c5b0fc7a04ac61 Patch
https://git.kernel.org/stable/c/43768fa80fd192558737e24ed6548f74554611d7 Patch
https://git.kernel.org/stable/c/ad149f5585345e383baa65f1539d816cd715fd3b Patch
https://git.kernel.org/stable/c/f1aa7c509aa766080db7ab3aec2e31b1df09e57c Patch
https://git.kernel.org/stable/c/fa5bfdf6cb5846a00e712d630a43e3cf55ccb411 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*
History

13 Sep 2024, 16:36

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/046667c4d3196938e992fba0dfcde570aa85cd0e - () https://git.kernel.org/stable/c/046667c4d3196938e992fba0dfcde570aa85cd0e - Patch
References () https://git.kernel.org/stable/c/0fbe2a72e853a1052abe9bc2b7df8ddb102da227 - () https://git.kernel.org/stable/c/0fbe2a72e853a1052abe9bc2b7df8ddb102da227 - Patch
References () https://git.kernel.org/stable/c/1b37ec85ad95b612307627758c6018cd9d92cca8 - () https://git.kernel.org/stable/c/1b37ec85ad95b612307627758c6018cd9d92cca8 - Patch
References () https://git.kernel.org/stable/c/21b578f1d599edb87462f11113c5b0fc7a04ac61 - () https://git.kernel.org/stable/c/21b578f1d599edb87462f11113c5b0fc7a04ac61 - Patch
References () https://git.kernel.org/stable/c/43768fa80fd192558737e24ed6548f74554611d7 - () https://git.kernel.org/stable/c/43768fa80fd192558737e24ed6548f74554611d7 - Patch
References () https://git.kernel.org/stable/c/ad149f5585345e383baa65f1539d816cd715fd3b - () https://git.kernel.org/stable/c/ad149f5585345e383baa65f1539d816cd715fd3b - Patch
References () https://git.kernel.org/stable/c/f1aa7c509aa766080db7ab3aec2e31b1df09e57c - () https://git.kernel.org/stable/c/f1aa7c509aa766080db7ab3aec2e31b1df09e57c - Patch
References () https://git.kernel.org/stable/c/fa5bfdf6cb5846a00e712d630a43e3cf55ccb411 - () https://git.kernel.org/stable/c/fa5bfdf6cb5846a00e712d630a43e3cf55ccb411 - Patch
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: memcg_write_event_control(): corrige un error que puede ser activado por el usuario. Oops, *no* tenemos garantía de que todo lo que esté más allá del NUL de terminación se asigne (y mucho menos se inicialice con algo sensato).
First Time Linux linux Kernel
Linux
CWE CWE-476

11 Sep 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-09-11 16:15

Updated : 2024-09-13 16:36

NVD link : CVE-2024-45021

Mitre link : CVE-2024-45021

CVE.ORG link : CVE-2024-45021

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference