CVE-2024-36015: ppdev: Add an error check in register_device
In the Linux kernel, the following vulnerability has been resolved:
ppdev: Add an error check in registerdevice
In registerdevice, the return value of idasimpleget is unchecked, in witch idasimpleget will use an invalid index value.
To address this issue, index should be checked after idasimpleget. When the index value is abnormal, a warning message should be printed, the port should be dropped, and the value should be recorded.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
ppdev: Add an error check in registerdevice
The Linux kernel CVE team has assigned CVE-2024-36015 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024052957-CVE-2024-36015-3c7c@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.94-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.9.7-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
In ppdev register_device, check the return value of ida_simple_get; if the index is abnormal, print a warning, drop the port, and record the value.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36015?
CVE-2024-36015 has a medium severity rating due to its potential to cause resource mismanagement in the Linux kernel.
How do I fix CVE-2024-36015?
To fix CVE-2024-36015, update the kernel to versions 6.10 or specific patched versions provided by Red Hat and Debian.
What software is affected by CVE-2024-36015?
CVE-2024-36015 affects multiple kernel versions, specifically those prior to 6.10 for Red Hat and several versions for Debian, including 5.10.223-1 and 6.1.123-1.
What impact does CVE-2024-36015 have on systems?
CVE-2024-36015 can lead to system instability and potential access issues due to improper handling of device registration.
Is CVE-2024-36015 exploitable remotely?
CVE-2024-36015 is considered to be less likely to be exploited remotely but may still pose a risk depending on the system's configuration and exposure.