github - ghsa-rhm4-r455-38cm

ghsa-rhm4-r455-38cm

Vulnerability from github

Published

2024-07-29 15:30

Modified

2024-08-21 21:30

Severity ?

5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

In the Linux kernel, the following vulnerability has been resolved:

vfio/pci: Init the count variable in collecting hot-reset devices

The count variable is used without initialization, it results in mistakes in the device counting and crashes the userspace if the get hot reset info path is triggered.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-41052"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-908"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-29T15:15:13Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: Init the count variable in collecting hot-reset devices\n\nThe count variable is used without initialization, it results in mistakes\nin the device counting and crashes the userspace if the get hot reset info\npath is triggered.",
  "id": "GHSA-rhm4-r455-38cm",
  "modified": "2024-08-21T21:30:45Z",
  "published": "2024-07-29T15:30:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41052"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5a88a3f67e37e39f933b38ebb4985ba5822e9eca"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f44136b9652291ac1fc39ca67c053ac624d0d11b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f476dffc52ea70745dcabf63288e770e50ac9ab3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

cve-2024-41052

Vulnerability from cvelistv5

Published

2024-07-29 14:32

Modified

2024-11-05 09:35

Severity ?

Summary

vfio/pci: Init the count variable in collecting hot-reset devices

References

▼	URL	Tags
	https://git.kernel.org/stable/c/f476dffc52ea70745dcabf63288e770e50ac9ab3
	https://git.kernel.org/stable/c/f44136b9652291ac1fc39ca67c053ac624d0d11b
	https://git.kernel.org/stable/c/5a88a3f67e37e39f933b38ebb4985ba5822e9eca

Impacted products

Vendor

Product

Version

▼

Linux

Version: 618fbf4c910a
Version: 9313244c26f3
Version: f6944d4a0b87

Linux

Version: 6.6.36 ≤
Version: 6.9.7 ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:46:51.022Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f476dffc52ea70745dcabf63288e770e50ac9ab3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f44136b9652291ac1fc39ca67c053ac624d0d11b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5a88a3f67e37e39f933b38ebb4985ba5822e9eca"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-41052",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:22:38.248336Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:01.796Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/vfio/pci/vfio_pci_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f476dffc52ea",
              "status": "affected",
              "version": "618fbf4c910a",
              "versionType": "git"
            },
            {
              "lessThan": "f44136b96522",
              "status": "affected",
              "version": "9313244c26f3",
              "versionType": "git"
            },
            {
              "lessThan": "5a88a3f67e37",
              "status": "affected",
              "version": "f6944d4a0b87",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/vfio/pci/vfio_pci_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.6.41",
              "status": "affected",
              "version": "6.6.36",
              "versionType": "semver"
            },
            {
              "lessThan": "6.9.10",
              "status": "affected",
              "version": "6.9.7",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: Init the count variable in collecting hot-reset devices\n\nThe count variable is used without initialization, it results in mistakes\nin the device counting and crashes the userspace if the get hot reset info\npath is triggered."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-05T09:35:43.645Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f476dffc52ea70745dcabf63288e770e50ac9ab3"
        },
        {
          "url": "https://git.kernel.org/stable/c/f44136b9652291ac1fc39ca67c053ac624d0d11b"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a88a3f67e37e39f933b38ebb4985ba5822e9eca"
        }
      ],
      "title": "vfio/pci: Init the count variable in collecting hot-reset devices",
      "x_generator": {
        "engine": "bippy-9e1c9544281a"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-41052",
    "datePublished": "2024-07-29T14:32:08.262Z",
    "dateReserved": "2024-07-12T12:17:45.626Z",
    "dateUpdated": "2024-11-05T09:35:43.645Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted