CVE-2024-45008: Input: MT - limit max slots
In the Linux kernel, the following vulnerability has been resolved:
Input: MT - limit max slots
syzbot is reporting too large allocation at inputmtinitslots(), for numslots is supplied from userspace using ioctl(UIDEVCREATE).
Since nobody knows possible max slots, this patch chose 1024.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Configuration
Limit num_slots supplied through ioctl(UI_DEV_CREATE) to a maximum of 1024.
Linux kernel input MT subsystem maximum number of multitouch slots = 1024
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45008?
CVE-2024-45008 has been rated as a medium severity vulnerability due to the potential for large memory allocation issues.
How do I fix CVE-2024-45008?
To fix CVE-2024-45008, update the Linux kernel to one of the patched versions such as 5.10.226-1, 6.1.123-1, or later.
What are the affected versions for CVE-2024-45008?
CVE-2024-45008 affects Linux kernel versions up to 5.10.223-1, 6.1.119-1, and similar versions before the patches were applied.
What components are impacted by CVE-2024-45008?
CVE-2024-45008 impacts the input processing within the Linux kernel, specifically related to maximum slot allocation.
What is the potential impact of CVE-2024-45008?
The potential impact of CVE-2024-45008 can lead to excessive memory allocation, which may cause system instability or crashes.