CVE-2024-46745: Input: uinput - reject requests with unreasonable number of slots
In the Linux kernel, the following vulnerability has been resolved:
Input: uinput - reject requests with unreasonable number of slots
When exercising uinput interface syzkaller may try setting up device with a really large number of slots, which causes memory allocation failure in inputmtinitslots(). While this allocation failure is handled properly and request is rejected, it results in syzkaller reports. Additionally, such request may put undue burden on the system which will try to free a lot of memory for a bogus request.
Fix it by limiting allowed number of slots to 100. This can easily be extended if we see devices that can track more than 100 contacts.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-46745?
CVE-2024-46745 is considered a high severity vulnerability in the Linux kernel affecting memory allocation.
How do I fix CVE-2024-46745?
To fix CVE-2024-46745, update your Linux kernel to version 5.10.226-1, 6.1.123-1, or higher versions listed in the remediation.
What versions of Linux are affected by CVE-2024-46745?
CVE-2024-46745 affects Linux kernel versions up to 5.10.223-1 and specific versions listed as remedies.
What is the attack vector for CVE-2024-46745?
The attack vector for CVE-2024-46745 involves the uinput interface where an unreasonable number of slots may be requested, leading to memory allocation failures.
Does CVE-2024-46745 have any known exploits?
As of now, there are no public exploits available specifically targeting CVE-2024-46745.