CVE-2024-42249 (GCVE-0-2024-42249)

Vulnerability from cvelistv5 – Published: 2024-08-07 15:14 – Updated: 2026-08-05 11:36
VLAI
Title
spi: don't unoptimize message in spi_async()
Summary
In the Linux kernel, the following vulnerability has been resolved: spi: don't unoptimize message in spi_async() Calling spi_maybe_unoptimize_message() in spi_async() is wrong because the message is likely to be in the queue and not transferred yet. This can corrupt the message while it is being used by the controller driver. spi_maybe_unoptimize_message() is already called in the correct place in spi_finalize_current_message() to balance the call to spi_maybe_optimize_message() in spi_async().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 16:13 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7b1d87af14d9ae902ed0c5dc5fabf4eea5abdf02 , < 8b9af6d67517ce4a0015928b3cf35bfd2b1bc1c2 (git)
Affected: 7b1d87af14d9ae902ed0c5dc5fabf4eea5abdf02 , < c86a918b1bdba78fb155184f8d88dfba1e63335d (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.9
Unaffected: 0 , < 6.9 (semver)
Unaffected: 6.9.10 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42249",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:13:22.174843Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:30.786Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/spi/spi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8b9af6d67517ce4a0015928b3cf35bfd2b1bc1c2",
              "status": "affected",
              "version": "7b1d87af14d9ae902ed0c5dc5fabf4eea5abdf02",
              "versionType": "git"
            },
            {
              "lessThan": "c86a918b1bdba78fb155184f8d88dfba1e63335d",
              "status": "affected",
              "version": "7b1d87af14d9ae902ed0c5dc5fabf4eea5abdf02",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/spi/spi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.10",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: don\u0027t unoptimize message in spi_async()\n\nCalling spi_maybe_unoptimize_message() in spi_async() is wrong because\nthe message is likely to be in the queue and not transferred yet. This\ncan corrupt the message while it is being used by the controller driver.\n\nspi_maybe_unoptimize_message() is already called in the correct place\nin spi_finalize_current_message() to balance the call to\nspi_maybe_optimize_message() in spi_async()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is in the SPI core and is reached by causing local SPI traffic \u2014 a `/dev/spidevB.C` SPI_IOC_MESSAGE ioctl behind spi-mux, IIO buffer enable, regmap-async firmware download via an ALSA device, or netdev TX on an SPI transceiver. No network protocol parses attacker data here, so exploitation requires local system access.\nAC:L - The attacker controls both sides of the race \u2014 they submit the `spi_async()` messages that queue the work and simultaneously trigger the unsynchronized teardown, and can repeat this thousands of times per second from multiple threads to widen the window and groom the freed slab. On spi-axi-spi-engine the free reliably wins, yielding a deterministic NULL deref of `msg-\u003eopt_state`.\nPR:L - An ordinary unprivileged local user suffices: spidev nodes are commonly group-readable/writable on embedded and SBC images, IIO buffer sysfs and ALSA PCM/firmware-download paths are similarly group-accessible, and CAN/802.15.4 socket TX drives `spi_async()` too. No root or capability in the init namespace is needed.\nUI:N - The attacker\u0027s own syscalls generate the SPI messages that race with the controller worker; no action by any other user is required.\nS:U - The corruption is confined to kernel slab memory and the SPI core\u0027s own data structures, all within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The use-after-free lets the controller read `tx_buf`/`rx_buf`/`len` out of a freed and reallocatable `struct spi_transfer`, so arbitrary kernel memory can be clocked out on the SPI bus and received data DMA\u0027d to an attacker-influenced address; the freed spi-engine program is likewise pushed byte-for-byte into the hardware command FIFO.\nI:H - `spi_res_release()` can run twice on the same message (the unlocked `msg-\u003eoptimized` check-and-clear races with `spi_finalize_current_message()`), giving a double free of a kmalloc\u0027d object plus concurrent `list_splice`/`list_del` against live list traversal \u2014 SLUB freelist and linked-list corruption that yields a write primitive.\nA:H - In the common case the free wins and `spi_engine_transfer_one_message()` dereferences a NULL `msg-\u003eopt_state`, and list corruption or a restored oversized transfer likewise oopses the kernel \u2014 an immediate panic that an unprivileged user can trigger at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:36:03.625Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8b9af6d67517ce4a0015928b3cf35bfd2b1bc1c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/c86a918b1bdba78fb155184f8d88dfba1e63335d"
        }
      ],
      "title": "spi: don\u0027t unoptimize message in spi_async()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42249",
    "datePublished": "2024-08-07T15:14:33.418Z",
    "dateReserved": "2024-07-30T07:40:12.255Z",
    "dateUpdated": "2026-08-05T11:36:03.625Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-42249",
      "date": "2026-08-16",
      "epss": "0.00192",
      "percentile": "0.09193"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.9\", \"versionEndExcluding\": \"6.9.10\", \"matchCriteriaId\": \"0F5C3789-472B-40EC-9D2A-48169EDB592B\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nspi: don\u0027t unoptimize message in spi_async()\\n\\nCalling spi_maybe_unoptimize_message() in spi_async() is wrong because\\nthe message is likely to be in the queue and not transferred yet. This\\ncan corrupt the message while it is being used by the controller driver.\\n\\nspi_maybe_unoptimize_message() is already called in the correct place\\nin spi_finalize_current_message() to balance the call to\\nspi_maybe_optimize_message() in spi_async().\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: spi: no desoptimizar el mensaje en spi_async() Llamar a spi_maybe_unoptimize_message() en spi_async() es incorrecto porque es probable que el mensaje est\\u00e9 en la cola y a\\u00fan no se haya transferido. Esto puede da\\u00f1ar el mensaje mientras lo utiliza el controlador del controlador. spi_maybe_unoptimize_message() ya se llama en el lugar correcto en spi_finalize_current_message() para equilibrar la llamada a spi_maybe_optimize_message() en spi_async().\"}]",
      "id": "CVE-2024-42249",
      "lastModified": "2024-08-08T20:55:25.943",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\", \"baseScore\": 3.3, \"baseSeverity\": \"LOW\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 1.4}]}",
      "published": "2024-08-07T16:15:47.510",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/8b9af6d67517ce4a0015928b3cf35bfd2b1bc1c2\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/c86a918b1bdba78fb155184f8d88dfba1e63335d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-42249\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-07T16:15:47.510\",\"lastModified\":\"2026-08-04T11:19:41.690\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nspi: don\u0027t unoptimize message in spi_async()\\n\\nCalling spi_maybe_unoptimize_message() in spi_async() is wrong because\\nthe message is likely to be in the queue and not transferred yet. This\\ncan corrupt the message while it is being used by the controller driver.\\n\\nspi_maybe_unoptimize_message() is already called in the correct place\\nin spi_finalize_current_message() to balance the call to\\nspi_maybe_optimize_message() in spi_async().\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: spi: no desoptimizar el mensaje en spi_async() Llamar a spi_maybe_unoptimize_message() en spi_async() es incorrecto porque es probable que el mensaje est\u00e9 en la cola y a\u00fan no se haya transferido. Esto puede da\u00f1ar el mensaje mientras lo utiliza el controlador del controlador. spi_maybe_unoptimize_message() ya se llama en el lugar correcto en spi_finalize_current_message() para equilibrar la llamada a spi_maybe_optimize_message() en spi_async().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/spi/spi.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7b1d87af14d9ae902ed0c5dc5fabf4eea5abdf02\",\"lessThan\":\"8b9af6d67517ce4a0015928b3cf35bfd2b1bc1c2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7b1d87af14d9ae902ed0c5dc5fabf4eea5abdf02\",\"lessThan\":\"c86a918b1bdba78fb155184f8d88dfba1e63335d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/spi/spi.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.9\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.9\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.10\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\",\"baseScore\":3.3,\"baseSeverity\":\"LOW\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.8,\"impactScore\":1.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T16:13:22.174843Z\",\"id\":\"CVE-2024-42249\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.9\",\"versionEndExcluding\":\"6.9.10\",\"matchCriteriaId\":\"0F5C3789-472B-40EC-9D2A-48169EDB592B\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/8b9af6d67517ce4a0015928b3cf35bfd2b1bc1c2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c86a918b1bdba78fb155184f8d88dfba1e63335d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:43:31+00:00",
      "cve": "CVE-2024-42249",
      "id": "CVE-2024-42249",
      "initial_release_date": "2024-08-07T00:00:00+00:00",
      "product_status:known_affected": "28",
      "product_status:known_not_affected": "170",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: spi: don\u0027t unoptimize message in spi_async()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-42249.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T01:42:30Z",
      "cve": "CVE-2024-42249",
      "id": "CVE-2024-42249",
      "initial_release_date": "2024-08-08T02:20:12Z",
      "product_status:known_not_affected": "310",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-42249",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-42249.json",
      "version": "19"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-42249\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:13:22.174843Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:24.117Z\"}}], \"cna\": {\"title\": \"spi: don\u0027t unoptimize message in spi_async()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"7b1d87af14d9ae902ed0c5dc5fabf4eea5abdf02\", \"lessThan\": \"8b9af6d67517ce4a0015928b3cf35bfd2b1bc1c2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7b1d87af14d9ae902ed0c5dc5fabf4eea5abdf02\", \"lessThan\": \"c86a918b1bdba78fb155184f8d88dfba1e63335d\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/spi/spi.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.9\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.9\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.9.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/spi/spi.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/8b9af6d67517ce4a0015928b3cf35bfd2b1bc1c2\"}, {\"url\": \"https://git.kernel.org/stable/c/c86a918b1bdba78fb155184f8d88dfba1e63335d\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nspi: don\u0027t unoptimize message in spi_async()\\n\\nCalling spi_maybe_unoptimize_message() in spi_async() is wrong because\\nthe message is likely to be in the queue and not transferred yet. This\\ncan corrupt the message while it is being used by the controller driver.\\n\\nspi_maybe_unoptimize_message() is already called in the correct place\\nin spi_finalize_current_message() to balance the call to\\nspi_maybe_optimize_message() in spi_async().\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.10\", \"versionStartIncluding\": \"6.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"6.9\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:25:04.122Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-42249\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T09:25:04.122Z\", \"dateReserved\": \"2024-07-30T07:40:12.255Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-07T15:14:33.418Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.