CVE-2024-45021

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-45021
In the Linux kernel, the following vulnerability has been resolved: memcg_write_event_control(): fix a user-triggerable oops we are *not* guaranteed that anything past the terminating NUL is mapped (let alone initialized with anything sane).

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/046667c4d3196938e992fba0dfcde570aa85cd0e Patch
https://git.kernel.org/stable/c/0fbe2a72e853a1052abe9bc2b7df8ddb102da227 Patch
https://git.kernel.org/stable/c/1b37ec85ad95b612307627758c6018cd9d92cca8 Patch
https://git.kernel.org/stable/c/21b578f1d599edb87462f11113c5b0fc7a04ac61 Patch
https://git.kernel.org/stable/c/43768fa80fd192558737e24ed6548f74554611d7 Patch
https://git.kernel.org/stable/c/ad149f5585345e383baa65f1539d816cd715fd3b Patch
https://git.kernel.org/stable/c/f1aa7c509aa766080db7ab3aec2e31b1df09e57c Patch
https://git.kernel.org/stable/c/fa5bfdf6cb5846a00e712d630a43e3cf55ccb411 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*
History

13 Sep 2024, 16:36

Type Values Removed Values Added
First Time Linux linux Kernel
Linux
CWE CWE-476
References () https://git.kernel.org/stable/c/046667c4d3196938e992fba0dfcde570aa85cd0e - () https://git.kernel.org/stable/c/046667c4d3196938e992fba0dfcde570aa85cd0e - Patch
References () https://git.kernel.org/stable/c/0fbe2a72e853a1052abe9bc2b7df8ddb102da227 - () https://git.kernel.org/stable/c/0fbe2a72e853a1052abe9bc2b7df8ddb102da227 - Patch
References () https://git.kernel.org/stable/c/1b37ec85ad95b612307627758c6018cd9d92cca8 - () https://git.kernel.org/stable/c/1b37ec85ad95b612307627758c6018cd9d92cca8 - Patch
References () https://git.kernel.org/stable/c/21b578f1d599edb87462f11113c5b0fc7a04ac61 - () https://git.kernel.org/stable/c/21b578f1d599edb87462f11113c5b0fc7a04ac61 - Patch
References () https://git.kernel.org/stable/c/43768fa80fd192558737e24ed6548f74554611d7 - () https://git.kernel.org/stable/c/43768fa80fd192558737e24ed6548f74554611d7 - Patch
References () https://git.kernel.org/stable/c/ad149f5585345e383baa65f1539d816cd715fd3b - () https://git.kernel.org/stable/c/ad149f5585345e383baa65f1539d816cd715fd3b - Patch
References () https://git.kernel.org/stable/c/f1aa7c509aa766080db7ab3aec2e31b1df09e57c - () https://git.kernel.org/stable/c/f1aa7c509aa766080db7ab3aec2e31b1df09e57c - Patch
References () https://git.kernel.org/stable/c/fa5bfdf6cb5846a00e712d630a43e3cf55ccb411 - () https://git.kernel.org/stable/c/fa5bfdf6cb5846a00e712d630a43e3cf55ccb411 - Patch
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: memcg_write_event_control(): corrige un error que puede ser activado por el usuario. Oops, *no* tenemos garantía de que todo lo que esté más allá del NUL de terminación se asigne (y mucho menos se inicialice con algo sensato).
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*

11 Sep 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-09-11 16:15

Updated : 2024-09-13 16:36

NVD link : CVE-2024-45021

Mitre link : CVE-2024-45021

CVE.ORG link : CVE-2024-45021

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference