Medium · published November 19, 2024
CVSS calls it medium at 5.5. It is confirmed in active exploitation. It sits in the 56.5th percentile for exploit probability.
⚠️ A crafty report buffer could be your kernel's Achilles' heel! This vulnerability allows specially-crafted reports to potentially leak sensitive memory. 🔍 Think of the report buffer as a shared notepad in a busy office. If it isn't wiped clean after use, the next person might accidentally read confidential notes left behind by the previous occupant, leading to some serious mix-ups! An attacker could exploit this vulnerability to access sensitive kernel memory, risking data leakage that could compromise system integrity. While the exploit requires specific conditions, the consequences could be a headache for any system administrator, making it important to address.
Think of the report buffer as a shared notepad in a busy office. If it isn't wiped clean after use, the next person might accidentally read confidential notes left behind by the previous occupant, leading to some serious mix-ups! This vulnerability in the Linux kernel's HID core results from the report buffer not being zero-initialized during allocation, allowing potential leakage of kernel memory via specially-crafted reports.
An attacker could exploit this vulnerability to access sensitive kernel memory, risking data leakage that could compromise system integrity. While the exploit requires specific conditions, the consequences could be a headache for any system administrator, making it important to address. Update the Linux kernel to the latest version that resolves this issue, ensuring that the report buffer is zero-initialized during allocation. Regularly audit your kernel versions to prevent exploitation. 🛡️ You've got this! With these steps, you'll be back in control and keeping your systems secure! 💪✨
| Product | Versions | Fixed in |
|---|---|---|
| google/android | all versions | — |
| debian/debian_linux | all versions | — |
| siemens/simatic_s7-1500_tm_mfp_firmware | all versions | — |
| siemens/sinec_os | < 3.2 | 3.2 |
| linux/linux_kernel | ≥ 3.12, < 4.19.324 | 4.19.324 |
| linux/linux_kernel | ≥ 4.20, < 5.4.286 | 5.4.286 |
| linux/linux_kernel | ≥ 5.5, < 5.10.230 | 5.10.230 |
| linux/linux_kernel | ≥ 5.11, < 5.15.172 | 5.15.172 |
| linux/linux_kernel | ≥ 5.16, < 6.1.117 | 6.1.117 |
| linux/linux_kernel | ≥ 6.2, < 6.6.61 | 6.6.61 |
| linux/linux_kernel | ≥ 6.7, < 6.11.8 | 6.11.8 |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |