CVE-2024-44931: gpio: prevent potential speculation leaks in gpio_device_get_desc()
gpio: prevent potential speculation leaks in gpiodevicegetdesc()
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.15.176.3-1 - Configuration
Update the Linux kernel gpio code so that the user-provided offset used as an index in gpio_device_get_desc() is sanitized by using array_index_nospec(), mitigating speculative information leaks when userspace calls gpio_ioctl() with an out-of-range offset.
Linux kernel gpio offset sanitization in gpio_device_get_desc() = use array_index_nospec()
Event History
Frequently Asked Questions
What is the severity of CVE-2024-44931?
CVE-2024-44931 has been rated as a high severity vulnerability due to its potential for speculative information leaks.
How do I fix CVE-2024-44931?
To fix CVE-2024-44931, upgrade the Linux kernel to versions 6.6.46 or later, or ensure you are running a patched version of affected Linux distributions.
Who is affected by CVE-2024-44931?
CVE-2024-44931 affects users of specific versions of the Linux kernel, particularly those in the 6.7 to 6.10.5 range and below 6.1.123.
What is the impact of CVE-2024-44931 on systems?
The impact of CVE-2024-44931 includes the possible exposure of sensitive data through speculative reads triggered by user actions.
Is there a workaround for CVE-2024-44931?
Currently, the best approach for CVE-2024-44931 is to apply the available patches rather than relying on a workaround.