CVE-2024-50270
Nov. 26, 2024, 10:38 p.m.
Tags
CVSS Score
Products Impacted
Vendor | Product | Versions |
---|---|---|
linux |
|
|
Description
In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: avoid overflow in damon_feed_loop_next_input() damon_feed_loop_next_input() is inefficient and fragile to overflows. Specifically, 'score_goal_diff_bp' calculation can overflow when 'score' is high. The calculation is actually unnecessary at all because 'goal' is a constant of value 10,000. Calculation of 'compensation' is again fragile to overflow. Final calculation of return value for under-achiving case is again fragile to overflow when the current score is under-achieving the target. Add two corner cases handling at the beginning of the function to make the body easier to read, and rewrite the body of the function to avoid overflows and the unnecessary bp value calcuation.
Weaknesses
CWE-190
Integer Overflow or Wraparound
The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.
CWE ID: 190Date
Published: Nov. 19, 2024, 2:16 a.m.
Last Modified: Nov. 26, 2024, 10:38 p.m.
Status : Analyzed
CVE has been recently published to the CVE List and has been received by the NVD.
More infoSource
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CPEs
Type | Vendor | Product | Version | Update | Edition | Language | Software Edition | Target Software | Target Hardware | Other Information |
---|---|---|---|---|---|---|---|---|---|---|
o | linux | linux_kernel | / | / | / | / | / | / | / | / |
o | linux | linux_kernel | 6.12 | rc1 | / | / | / | / | / | / |
o | linux | linux_kernel | 6.12 | rc2 | / | / | / | / | / | / |
o | linux | linux_kernel | 6.12 | rc3 | / | / | / | / | / | / |
o | linux | linux_kernel | 6.12 | rc4 | / | / | / | / | / | / |
o | linux | linux_kernel | 6.12 | rc5 | / | / | / | / | / | / |
o | linux | linux_kernel | 6.12 | rc6 | / | / | / | / | / | / |
CVSS Data
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
Base Score
Exploitability Score
Impact Score
Base Severity
MEDIUMCVSS Vector String
The CVSS vector string provides an in-depth view of the vulnerability metrics.
View Vector StringCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H