CVE-2024-49860

Nov. 8, 2024, 4:15 p.m.

7.1
High

Description

In the Linux kernel, the following vulnerability has been resolved: ACPI: sysfs: validate return type of _STR method Only buffer objects are valid return values of _STR. If something else is returned description_show() will access invalid memory.

Product(s) Impacted

Vendor Product Versions
Linux
  • Linux Kernel
  • *

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-843
Access of Resource Using Incompatible Type ('Type Confusion')
The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
o linux linux_kernel / / / / / / / /
o linux linux_kernel / / / / / / / /
o linux linux_kernel / / / / / / / /
o linux linux_kernel / / / / / / / /
o linux linux_kernel / / / / / / / /
o linux linux_kernel / / / / / / / /

References

https://git.kernel.org/stable/c/0cdfb9178a3bba843c95c2117c82c15f1a64b9ce
https://git.kernel.org/stable/c/2364b6af90c6b6d8a4783e0d3481ca80af699554
https://git.kernel.org/stable/c/4b081991c4363e072e1748efed0bbec8a77daba5
https://git.kernel.org/stable/c/4bb1e7d027413835b086aed35bc3f0713bc0f72b
https://git.kernel.org/stable/c/5c8d007c14aefc3f2ddf71e4c40713733dc827be
https://git.kernel.org/stable/c/92fd5209fc014405f63a7db79802ca4b01dc0c05
https://git.kernel.org/stable/c/f0921ecd4ddc14646bb5511f49db4d7d3b0829f0
https://git.kernel.org/stable/c/f51e5a88f2e7224858b261546cf6b3037dfb1323
https://git.kernel.org/stable/c/f51f711d36e61fbb87c67b524fd200e05172668d

Tags

416baaa9-dc9f-4396-8d5f-8c081fb06d67
CWE-843
2024-10-21
CVE-2024-49860

CVSS Score

7.1 / 10

CVSS Data - 3.1

  • Attack Vector: LOCAL
  • Attack Complexity: LOW
  • Privileges Required: LOW
  • Scope: UNCHANGED
  • Confidentiality Impact: HIGH
  • Integrity Impact: NONE
  • Availability Impact: HIGH

    • CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

    View Vector String

Timeline

Published: Oct. 21, 2024, 1:15 p.m.
Last Modified: Nov. 8, 2024, 4:15 p.m.

Status : Modified

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

416baaa9-dc9f-4396-8d5f-8c081fb06d67

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.