CVE-2024-36898: linux-libc-dev - gpiolib: cdev: fix uninitialised kfifo
Summary
CVE-2024-36898: In the Linux kernel, the following vulnerability has been resolved: gpiolib: cdev: fix uninitialised kfifo If a line is requested with debounce, and that results in debouncing in software, and the line is subsequently re... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux-libc-dev package is a development package that provides the necessary header files and libraries for compiling C programs that use the Linux kernel interfaces. It is an essential component for building and linking applications with the Linux kernel. The vulnerability in the gpiolib component of the linux-libc-dev package allows for the use of an uninitialized kfifo, which can lead to events being written to and read from the kfifo without proper initialization. This vulnerability affects the version 6.1.90-1 of the linux-libc-dev package.
Vulnerability Detail
The vulnerability arises when a line is requested with debounce, resulting in software debouncing. If the line is then reconfigured to enable edge detection, the allocation of the kfifo to contain edge events is overlooked, leading to events being written to and read from an uninitialized kfifo. This can result in read events being returned to userspace. The vulnerability has been resolved by initializing the kfifo in cases where software debounce is already active. The vulnerability has a CVSS score of 5.5, indicating a medium severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The linux-libc-dev package version 6.1.90-1 is affected by the CVE-2024-36898 vulnerability in the gpiolib component. It allows for the use of an uninitialized kfifo, leading to events being written to and read from the kfifo without proper initialization. To fix the vulnerability, it is recommended to update the linux-libc-dev package to a version that includes the fix. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
The linux-libc-dev package provides the necessary header files and libraries for compiling C programs that use the Linux kernel interfaces.
The vulnerability allows for the use of an uninitialized kfifo, which can lead to events being written to and read from the kfifo without proper initialization. This can result in read events being returned to userspace.
To fix the vulnerability, update the linux-libc-dev package to a version that includes the fix. Recompile and relink any applications that depend on the linux-libc-dev package to ensure they are using the patched version.
No specific workaround has been mentioned for this vulnerability.
The vulnerability has a CVSS score of 5.5, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
