CVE-2024-40994: ptp: fix integer overflow in max_vclocks_store
Published Jul 12, 2024
·Updated
In the Linux kernel, the following vulnerability has been resolved:
ptp: fix integer overflow in maxvclocksstore
On 32bit systems, the "4 max" multiply can overflow. Use kcalloc() to do the allocation to prevent this.
Affected Software
12 affected componentsFixes available
Linux Linux kernel>=5.14<5.15.162
Linux Linux kernel>=5.16<6.1.96
Linux Linux kernel>=6.2<6.6.36
Linux Linux kernel>=6.7<6.9.7
Linux Linux kernel=6.10-rc1
Linux Linux kernel=6.10-rc2
Linux Linux kernel=6.10-rc3
Linux Linux kernel=6.10-rc4
debian/linux
5.10.223-15.10.234-16.1.129-16.1.135-16.12.22-16.12.25-1
debian/linux-6.1
6.1.129-1~deb11u1
Microsoft azl3 kernel 6.6.35.1-5
Microsoft azl3 kernel 6.6.47.1-1
Remediation
Event History
Jul 12, 2024
CVE Published
via MITRE·12:37 PM
Data Sourced
via MITRE·12:37 PM
Description
Data Sourced
via NVD·01:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Sep 11, 2024
Data Sourced
via Microsoft·07:00 AM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·07:00 AM
Affected Software
Updated
via Microsoft·07:00 AM
DescriptionSeverity
Apr 27, 2025
Data Sourced
via Ubuntu·06:15 PM
RemedyDescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-40994?
CVE-2024-40994 is considered a medium severity vulnerability affecting the Linux kernel.
2
How do I fix CVE-2024-40994?
To fix CVE-2024-40994, update to a patched version of the Linux kernel, such as 5.10.223-1 or later.
3
Which versions of the Linux kernel are affected by CVE-2024-40994?
CVE-2024-40994 affects Linux kernel versions from 5.14 to 6.9.7, including various release candidates.
4
What kind of systems are impacted by CVE-2024-40994?
CVE-2024-40994 impacts 32-bit systems due to potential integer overflow during memory allocation.
5
Is CVE-2024-40994 specific to any distributions?
CVE-2024-40994 is relevant across multiple Linux distributions that utilize the affected kernels, particularly Debian.