CVE-2024-50076: vt: prevent kernel-infoleak in con_font_get()
In the Linux kernel, the following vulnerability has been resolved:
vt: prevent kernel-infoleak in confontget()
font.data may not initialize all memory spaces depending on the implementation of vc->vcsw->confontget. This may cause info-leak, so to prevent this, it is safest to modify it to initialize the allocated memory space to 0, and it generally does not affect the overall performance of the system.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.133-1Fixed in 6.12.22-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50076?
CVE-2024-50076 has a medium severity rating due to the potential information leak.
How do I fix CVE-2024-50076?
To fix CVE-2024-50076, update to the latest stable version of the Linux kernel that addresses this vulnerability.
What versions of the Linux kernel are affected by CVE-2024-50076?
CVE-2024-50076 affects Linux kernel versions between 6.3 and 6.6.58, and specific release candidates from version 6.12.
What type of vulnerability is CVE-2024-50076?
CVE-2024-50076 is characterized as an information leak vulnerability in the Linux kernel.
Can CVE-2024-50076 be exploited remotely?
CVE-2024-50076 does not appear to have a remote exploitation vector, but could be leveraged in local environments.