CVE-2024-49973: r8169: add tally counter fields added with RTL8125
In the Linux kernel, the following vulnerability has been resolved:
r8169: add tally counter fields added with RTL8125
RTL8125 added fields to the tally counter, what may result in the chip dma'ing these new fields to unallocated memory. Therefore make sure that the allocated memory area is big enough to hold all of the tally counter values, even if we use only parts of it.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-49973?
CVE-2024-49973 has been classified with a severity level that indicates it may lead to DMA'ing to unallocated memory, which poses potential security risks.
How do I fix CVE-2024-49973?
To fix CVE-2024-49973, update to the latest affected Linux kernel version as provided by your distribution.
Which Linux kernel versions are affected by CVE-2024-49973?
CVE-2024-49973 affects Linux kernel versions from 5.4 to 6.11.3, including several specific version ranges.
What specific issue does CVE-2024-49973 address?
CVE-2024-49973 addresses a vulnerability related to the addition of tally counter fields in the RTL8125 network driver.
Is there a recommended version to upgrade to for CVE-2024-49973?
The recommended versions to upgrade to for CVE-2024-49973 include recent releases such as 6.1.123-1 and 6.12.12-1.