CVE-2024-46844: um: line: always fill *error_out in setup_one_line()
In the Linux kernel, the following vulnerability has been resolved:
um: line: always fill errorout in setuponeline()
The pointer isn't initialized by callers, but I have encountered cases where it's still printed; initialize it in all possible cases in setuponeline().
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-46844?
CVE-2024-46844 has been classified as having a medium severity level due to its impact on error handling in the Linux kernel.
Which versions of the Linux kernel are affected by CVE-2024-46844?
CVE-2024-46844 affects multiple versions of the Linux kernel, specifically versions from 4.19.322 up to but not including 6.6.51.
How do I fix CVE-2024-46844?
To remediate CVE-2024-46844, users should upgrade to patched versions of the Linux kernel, specifically to 5.10.226-1 or newer, or 6.1.123-1 or newer.
Is CVE-2024-46844 a critical vulnerability in the Linux kernel?
No, CVE-2024-46844 is not classified as a critical vulnerability, though it is crucial to address to prevent potential exploitation.
What is the nature of the flaw in CVE-2024-46844?
CVE-2024-46844 involves the uninitialized pointer not being handled correctly in the setup_one_line() function, which can lead to improper error reporting.