IM
IronMonkey Threat Research

CVE-2024-49973 HIGH

Published: 2024-10-21 | Last Modified: 2026-08-04 | Status: Modified

Description

In the Linux kernel, the following vulnerability has been resolved: r8169: add tally counter fields added with RTL8125 RTL8125 added fields to the tally counter, what may result in the chip dma'ing these new fields to unallocated memory. Therefore make sure that the allocated memory area is big enough to hold all of the tally counter values, even if we use only parts of it.

Additional Descriptions (1)

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: r8169: se agregaron campos del contador de recuento con RTL8125. RTL8125 agregó campos al contador de recuento, lo que puede provocar que el chip desactive estos nuevos campos en la memoria no asignada. Por lo tanto, asegúrese de que el área de memoria asignada sea lo suficientemente grande como para contener todos los valores del contador de recuento, incluso si solo usamos partes de ella.

CVSS Metrics

Base Score: 5.5 (MEDIUM)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack VectorLOCAL
Attack ComplexityLOW
Privileges RequiredLOW
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 1.8

Impact Score: 3.6

Weaknesses

Source Type Description
[email protected] Primary
en NVD-CWE-noinfo

Affected Products

Vendor Product Version Update Type
linux linux_kernel * <built-in method update of dict object at 0x7fd31b236680> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd31b237c00> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd34927e4c0> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd34927f940> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd31b237000> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd31b236fc0> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

References