CVE-2024-24891 (GCVE-0-2024-24891)
Vulnerability from cvelistv5 – Published: 2024-04-15 12:03 – Updated: 2024-08-20 17:41
VLAI?
Title
Information Leakage in kernel
Summary
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in openEuler kernel on Linux allows Resource Leak Exposure. This vulnerability is associated with program files https://gitee.Com/openeuler/kernel/blob/openEuler-1.0-LTS/drivers/staging/gmjstcm/tcm.C.
This issue affects kernel: from 4.19.90-2109.1.0.0108 before 4.19.90-2403.4.0.0244.
Severity ?
6 (Medium)
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
Impacted products
Credits
chlu22@m.fudan.edu.cn
caoyh23@m.fudan.edu.cn
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:28:12.962Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1358"
},
{
"tags": [
"x_transferred"
],
"url": "https://gitee.com/openeuler/kernel/pulls/2810"
},
{
"tags": [
"x_transferred"
],
"url": "https://gitee.com/src-openeuler/kernel/pulls/1321"
},
{
"tags": [
"x_transferred"
],
"url": "https://gitee.com/src-openeuler/kernel/pulls/1320"
},
{
"tags": [
"x_transferred"
],
"url": "https://gitee.com/src-openeuler/kernel/pulls/1322"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-24891",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-20T17:41:09.914934Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-20T17:41:19.874Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://gitee.com/openeuler",
"defaultStatus": "unaffected",
"packageName": "kernel",
"platforms": [
"Linux"
],
"product": "kernel",
"programFiles": [
"https://gitee.com/openeuler/kernel/blob/openEuler-1.0-LTS/drivers/staging/gmjstcm/tcm.c"
],
"repo": "https://gitee.com/openeuler/kernel",
"vendor": "openEuler",
"versions": [
{
"changes": [
{
"at": "c04a1c6afc6bca0fa5739ecf4f58e4723d82e82f",
"status": "unaffected"
},
{
"at": "4a049cbb02e83fdd7bd9400b6b6b27d1cda4fc99",
"status": "unaffected"
},
{
"at": "08f66d6cf651fabd9dff262c300cb8cd7f8f0741",
"status": "unaffected"
},
{
"at": "a3360846085a5558e5d8f9dd42a5c2e83345b4db",
"status": "unaffected"
}
],
"lessThan": "4.19.90-2403.4.0.0244",
"status": "affected",
"version": "4.19.90-2109.1.0.0108",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "chlu22@m.fudan.edu.cn"
},
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "caoyh23@m.fudan.edu.cn"
}
],
"datePublic": "2024-04-03T02:06:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in openEuler kernel on Linux allows Resource Leak Exposure.\u003cp\u003e This vulnerability is associated with program files \u003ctt\u003ehttps://gitee.Com/openeuler/kernel/blob/openEuler-1.0-LTS/drivers/staging/gmjstcm/tcm.C\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThis issue affects kernel: from 4.19.90-2109.1.0.0108 before 4.19.90-2403.4.0.0244.\u003c/p\u003e"
}
],
"value": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in openEuler kernel on Linux allows Resource Leak Exposure. This vulnerability is associated with program files https://gitee.Com/openeuler/kernel/blob/openEuler-1.0-LTS/drivers/staging/gmjstcm/tcm.C.\n\nThis issue affects kernel: from 4.19.90-2109.1.0.0108 before 4.19.90-2403.4.0.0244.\n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-131",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-131 Resource Leak Exposure"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-15T12:03:40.643Z",
"orgId": "7e1ac599-2767-43fa-b3ea-f10178cc98f2",
"shortName": "openEuler"
},
"references": [
{
"url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1358"
},
{
"url": "https://gitee.com/openeuler/kernel/pulls/2810"
},
{
"url": "https://gitee.com/src-openeuler/kernel/pulls/1321"
},
{
"url": "https://gitee.com/src-openeuler/kernel/pulls/1320"
},
{
"url": "https://gitee.com/src-openeuler/kernel/pulls/1322"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Information Leakage in kernel",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e1ac599-2767-43fa-b3ea-f10178cc98f2",
"assignerShortName": "openEuler",
"cveId": "CVE-2024-24891",
"datePublished": "2024-04-15T12:03:40.643Z",
"dateReserved": "2024-02-01T12:52:39.757Z",
"dateUpdated": "2024-08-20T17:41:19.874Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"descriptions": "[{\"lang\": \"en\", \"value\": \"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in openEuler kernel on Linux allows Resource Leak Exposure. This vulnerability is associated with program files https://gitee.Com/openeuler/kernel/blob/openEuler-1.0-LTS/drivers/staging/gmjstcm/tcm.C.\\n\\nThis issue affects kernel: from 4.19.90-2109.1.0.0108 before 4.19.90-2403.4.0.0244.\\n\\n\"}, {\"lang\": \"es\", \"value\": \"La exposici\\u00f3n de informaci\\u00f3n confidencial a una vulnerabilidad de actor no autorizado en el kernel openEuler en Linux permite la exposici\\u00f3n a fugas de recursos. Esta vulnerabilidad est\\u00e1 asociada con archivos de programa https://gitee.Com/openeuler/kernel/blob/openEuler-1.0-LTS/drivers/staging/gmjstcm/tcm.C. Este problema afecta al kernel: desde 4.19.90-2109.1.0.0108 antes de 4.19.90-2403.4.0.0244.\"}]",
"id": "CVE-2024-24891",
"lastModified": "2024-11-21T08:59:56.067",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"securities@openeuler.org\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N\", \"baseScore\": 6.0, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.5, \"impactScore\": 4.0}]}",
"published": "2024-04-15T12:15:13.233",
"references": "[{\"url\": \"https://gitee.com/openeuler/kernel/pulls/2810\", \"source\": \"securities@openeuler.org\"}, {\"url\": \"https://gitee.com/src-openeuler/kernel/pulls/1320\", \"source\": \"securities@openeuler.org\"}, {\"url\": \"https://gitee.com/src-openeuler/kernel/pulls/1321\", \"source\": \"securities@openeuler.org\"}, {\"url\": \"https://gitee.com/src-openeuler/kernel/pulls/1322\", \"source\": \"securities@openeuler.org\"}, {\"url\": \"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1358\", \"source\": \"securities@openeuler.org\"}, {\"url\": \"https://gitee.com/openeuler/kernel/pulls/2810\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://gitee.com/src-openeuler/kernel/pulls/1320\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://gitee.com/src-openeuler/kernel/pulls/1321\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://gitee.com/src-openeuler/kernel/pulls/1322\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1358\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
"sourceIdentifier": "securities@openeuler.org",
"vulnStatus": "Awaiting Analysis",
"weaknesses": "[{\"source\": \"securities@openeuler.org\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-200\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2024-24891\",\"sourceIdentifier\":\"securities@openeuler.org\",\"published\":\"2024-04-15T12:15:13.233\",\"lastModified\":\"2024-11-21T08:59:56.067\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in openEuler kernel on Linux allows Resource Leak Exposure. This vulnerability is associated with program files https://gitee.Com/openeuler/kernel/blob/openEuler-1.0-LTS/drivers/staging/gmjstcm/tcm.C.\\n\\nThis issue affects kernel: from 4.19.90-2109.1.0.0108 before 4.19.90-2403.4.0.0244.\\n\\n\"},{\"lang\":\"es\",\"value\":\"La exposici\u00f3n de informaci\u00f3n confidencial a una vulnerabilidad de actor no autorizado en el kernel openEuler en Linux permite la exposici\u00f3n a fugas de recursos. Esta vulnerabilidad est\u00e1 asociada con archivos de programa https://gitee.Com/openeuler/kernel/blob/openEuler-1.0-LTS/drivers/staging/gmjstcm/tcm.C. Este problema afecta al kernel: desde 4.19.90-2109.1.0.0108 antes de 4.19.90-2403.4.0.0244.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"securities@openeuler.org\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N\",\"baseScore\":6.0,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.5,\"impactScore\":4.0}]},\"weaknesses\":[{\"source\":\"securities@openeuler.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]}],\"references\":[{\"url\":\"https://gitee.com/openeuler/kernel/pulls/2810\",\"source\":\"securities@openeuler.org\"},{\"url\":\"https://gitee.com/src-openeuler/kernel/pulls/1320\",\"source\":\"securities@openeuler.org\"},{\"url\":\"https://gitee.com/src-openeuler/kernel/pulls/1321\",\"source\":\"securities@openeuler.org\"},{\"url\":\"https://gitee.com/src-openeuler/kernel/pulls/1322\",\"source\":\"securities@openeuler.org\"},{\"url\":\"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1358\",\"source\":\"securities@openeuler.org\"},{\"url\":\"https://gitee.com/openeuler/kernel/pulls/2810\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://gitee.com/src-openeuler/kernel/pulls/1320\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://gitee.com/src-openeuler/kernel/pulls/1321\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://gitee.com/src-openeuler/kernel/pulls/1322\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1358\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1358\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://gitee.com/openeuler/kernel/pulls/2810\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://gitee.com/src-openeuler/kernel/pulls/1321\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://gitee.com/src-openeuler/kernel/pulls/1320\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://gitee.com/src-openeuler/kernel/pulls/1322\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-01T23:28:12.962Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-24891\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-08-20T17:41:09.914934Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-20T17:41:17.092Z\"}}], \"cna\": {\"title\": \"Information Leakage in kernel\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"chlu22@m.fudan.edu.cn\"}, {\"lang\": \"en\", \"type\": \"finder\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"caoyh23@m.fudan.edu.cn\"}], \"impacts\": [{\"capecId\": \"CAPEC-131\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-131 Resource Leak Exposure\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 6, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://gitee.com/openeuler/kernel\", \"vendor\": \"openEuler\", \"product\": \"kernel\", \"versions\": [{\"status\": \"affected\", \"changes\": [{\"at\": \"c04a1c6afc6bca0fa5739ecf4f58e4723d82e82f\", \"status\": \"unaffected\"}, {\"at\": \"4a049cbb02e83fdd7bd9400b6b6b27d1cda4fc99\", \"status\": \"unaffected\"}, {\"at\": \"08f66d6cf651fabd9dff262c300cb8cd7f8f0741\", \"status\": \"unaffected\"}, {\"at\": \"a3360846085a5558e5d8f9dd42a5c2e83345b4db\", \"status\": \"unaffected\"}], \"version\": \"4.19.90-2109.1.0.0108\", \"lessThan\": \"4.19.90-2403.4.0.0244\", \"versionType\": \"git\"}], \"platforms\": [\"Linux\"], \"packageName\": \"kernel\", \"programFiles\": [\"https://gitee.com/openeuler/kernel/blob/openEuler-1.0-LTS/drivers/staging/gmjstcm/tcm.c\"], \"collectionURL\": \"https://gitee.com/openeuler\", \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2024-04-03T02:06:00.000Z\", \"references\": [{\"url\": \"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1358\"}, {\"url\": \"https://gitee.com/openeuler/kernel/pulls/2810\"}, {\"url\": \"https://gitee.com/src-openeuler/kernel/pulls/1321\"}, {\"url\": \"https://gitee.com/src-openeuler/kernel/pulls/1320\"}, {\"url\": \"https://gitee.com/src-openeuler/kernel/pulls/1322\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in openEuler kernel on Linux allows Resource Leak Exposure. This vulnerability is associated with program files https://gitee.Com/openeuler/kernel/blob/openEuler-1.0-LTS/drivers/staging/gmjstcm/tcm.C.\\n\\nThis issue affects kernel: from 4.19.90-2109.1.0.0108 before 4.19.90-2403.4.0.0244.\\n\\n\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in openEuler kernel on Linux allows Resource Leak Exposure.\u003cp\u003e This vulnerability is associated with program files \u003ctt\u003ehttps://gitee.Com/openeuler/kernel/blob/openEuler-1.0-LTS/drivers/staging/gmjstcm/tcm.C\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThis issue affects kernel: from 4.19.90-2109.1.0.0108 before 4.19.90-2403.4.0.0244.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-200\", \"description\": \"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor\"}]}], \"providerMetadata\": {\"orgId\": \"7e1ac599-2767-43fa-b3ea-f10178cc98f2\", \"shortName\": \"openEuler\", \"dateUpdated\": \"2024-04-15T12:03:40.643Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-24891\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-20T17:41:19.874Z\", \"dateReserved\": \"2024-02-01T12:52:39.757Z\", \"assignerOrgId\": \"7e1ac599-2767-43fa-b3ea-f10178cc98f2\", \"datePublished\": \"2024-04-15T12:03:40.643Z\", \"assignerShortName\": \"openEuler\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…