CVE-2024-36898CWE-908

CVE-2024-36898

High · published May 30, 2024

CVSS v3.1
7.1
EPSS
0%
Percentile
13.8
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

gpiolib: cdev: fix uninitialised kfifo

If a line is requested with debounce, and that results in debouncing

in software, and the line is subsequently reconfigured to enable edge

detection then the allocation of the kfifo to contain edge events is

overlooked. This results in events being written to and read from an

uninitialised kfifo. Read events are returned to userspace.

Initialise the kfifo in the case where the software debounce is

already active.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00236 · 13.8th percentile
Weakness
CWE-908 · Use of Uninitialized Resource
Published
2024-05-30T20:15Z
Affected products (11)
ProductVersionsFixed in
linux/linux_kernel≥ 5.10, < 5.15.2035.15.203
linux/linux_kernel≥ 5.16, < 6.1.916.1.91
linux/linux_kernel≥ 6.2, < 6.6.316.6.31
linux/linux_kernel≥ 6.7, < 6.8.106.8.10
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (9)
EPSS history
Timeline
  • 30 MAY 15:29Z
    gpiolib: cdev: fix uninitialised kfifo
    cvelistv5