CVE-2024-40994: ptp: fix integer overflow in max_vclocks_store
In the Linux kernel, the following vulnerability has been resolved:
ptp: fix integer overflow in maxvclocksstore
On 32bit systems, the "4 max" multiply can overflow. Use kcalloc() to do the allocation to prevent this.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.99-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.9.7-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
In the Linux kernel PTP max_vclocks_store implementation, use kcalloc() for the allocation to prevent the integer overflow in the 4 * max multiplication on 32-bit systems.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-40994?
CVE-2024-40994 is considered a medium severity vulnerability affecting the Linux kernel.
How do I fix CVE-2024-40994?
To fix CVE-2024-40994, update to a patched version of the Linux kernel, such as 5.10.223-1 or later.
Which versions of the Linux kernel are affected by CVE-2024-40994?
CVE-2024-40994 affects Linux kernel versions from 5.14 to 6.9.7, including various release candidates.
What kind of systems are impacted by CVE-2024-40994?
CVE-2024-40994 impacts 32-bit systems due to potential integer overflow during memory allocation.
Is CVE-2024-40994 specific to any distributions?
CVE-2024-40994 is relevant across multiple Linux distributions that utilize the affected kernels, particularly Debian.