CVE-2024-46745

CVE Details

Release Date:2024-09-18

Description


In the Linux kernel, the following vulnerability has been resolved:\nInput: uinput - reject requests with unreasonable number of slots\nWhen exercising uinput interface syzkaller may try setting up device\nwith a really large number of slots, which causes memory allocation\nfailure in input_mt_init_slots(). While this allocation failure is\nhandled properly and request is rejected, it results in syzkaller\nreports. Additionally, such request may put undue burden on the\nsystem which will try to free a lot of memory for a bogus request.\nFix it by limiting allowed number of slots to 100. This can easily\nbe extended if we see devices that can track more than 100 contacts.

See more information about CVE-2024-46745 from MITRE CVE dictionary and NIST NVD


NOTE: The following CVSS metrics and score provided are preliminary and subject to review.


CVSS v3 metrics

Base Score: 5.5
Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Version: 3.1
Attack Vector: Local
Attack Complexity: Low
Privileges Required: Low
User Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Errata information


PlatformErrataRelease Date
Oracle Linux version 7 (kernel-uek)ELSA-2024-128132024-11-12
Oracle Linux version 7 (kernel-uek)ELSA-2024-128682024-12-06
Oracle Linux version 8 (kernel-uek)ELSA-2024-128132024-11-12
Oracle Linux version 8 (kernel-uek)ELSA-2024-128152024-11-11
Oracle Linux version 9 (kernel-uek)ELSA-2024-128152024-11-11


This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections:

software.hardware.complete