CVE-2024-41028: platform/x86: toshiba_acpi: Fix array out-of-bounds access
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: toshibaacpi: Fix array out-of-bounds access
In order to use toshibadmiquirks[] together with the standard DMI matching functions, it must be terminated by a empty entry.
Since this entry is missing, an array out-of-bounds access occurs every time the quirk list is processed.
Fix this by adding the terminating empty entry.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Configuration
Update the toshiba_dmi_quirks[] array in platform/x86/toshiba_acpi so it is terminated by a terminating empty entry, ensuring standard DMI matching functions can process it without array out-of-bounds access.
Linux kernel platform/x86 toshiba_acpi toshida_dmi_quirks[] termination with empty entry = Append a terminating empty (sentinel) entry to toshiba_dmi_quirks[]
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41028?
CVE-2024-41028 is classified with moderate severity due to the potential for array out-of-bounds access in the Linux kernel.
How do I fix CVE-2024-41028?
To fix CVE-2024-41028, update to the patched versions of the Linux kernel: 5.10.223-1, 5.10.226-1, 6.1.119-1, 6.1.123-1, 6.12.10-1, or 6.12.11-1.
Which Linux versions are affected by CVE-2024-41028?
CVE-2024-41028 affects several Linux kernel versions, including those prior to the specified remedied versions.
What is the nature of the vulnerability in CVE-2024-41028?
CVE-2024-41028 involves an improper termination of the toshiba_dmi_quirks array, leading to a potential array out-of-bounds access.
Is CVE-2024-41028 limited to specific distributions?
While CVE-2024-41028 was identified in the Debian packages, similar kernel versions across other distributions may also be affected.