CVE-2024-40990

CVE-2024-40990

High · published July 12, 2024

CVSS v3.1
7.8
EPSS
0%
Percentile
19.4
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mlx5: Add check for srq max_sge attribute

max_sge attribute is passed by the user, and is inserted and used

unchecked, so verify that the value doesn't exceed maximum allowed value

before using it.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00280 · 19.4th percentile
Published
2024-07-12T17:15Z
Affected products (9)
ProductVersionsFixed in
linux/linux_kernel≥ 3.11, < 5.10.2215.10.221
linux/linux_kernel≥ 5.11, < 5.15.1625.15.162
linux/linux_kernel≥ 5.16, < 6.1.966.1.96
linux/linux_kernel≥ 6.2, < 6.6.366.6.36
linux/linux_kernel≥ 6.7, < 6.9.76.9.7
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (13)
EPSS history
Timeline
  • 12 JUL 12:37Z
    RDMA/mlx5: Add check for srq max_sge attribute
    cvelistv5