cvelistv5 - cve-2024-24862

CVE-2024-24862 (GCVE-0-2024-24862)

Vulnerability from cvelistv5 – Published: 2024-04-14 11:47 – Updated: 2024-05-29 07:03

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Replaced by CVE-2024-35883

Show details on NVD website

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2024-05-29T07:03:04.751Z",
        "orgId": "cb8f1db9-b4b1-487b-a760-f65c4f368d8e",
        "shortName": "Anolis"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
            }
          ],
          "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
        }
      ],
      "replacedBy": [
        "CVE-2024-35883"
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cb8f1db9-b4b1-487b-a760-f65c4f368d8e",
    "assignerShortName": "Anolis",
    "cveId": "CVE-2024-24862",
    "datePublished": "2024-04-14T11:47:15.737Z",
    "dateRejected": "2024-05-29T07:03:04.751Z",
    "dateReserved": "2024-02-01T09:11:56.216Z",
    "dateUpdated": "2024-05-29T07:03:04.751Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.\"}]",
      "id": "CVE-2024-24862",
      "lastModified": "2024-05-29T07:15:09.833",
      "published": "2024-04-14T13:15:48.400",
      "sourceIdentifier": "security@openanolis.org",
      "vulnStatus": "Rejected"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-24862\",\"sourceIdentifier\":\"security@openanolis.org\",\"published\":\"2024-04-14T13:15:48.400\",\"lastModified\":\"2024-05-29T07:15:09.833\",\"vulnStatus\":\"Rejected\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.\"}],\"metrics\":{},\"references\":[]}}"
  }
}

FKIE_CVE-2024-24862

Vulnerability from fkie_nvd - Published: 2024-04-14 13:15 - Updated: 2024-05-29 07:15

Severity ?

Summary

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

References

	URL	Tags

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
    }
  ],
  "id": "CVE-2024-24862",
  "lastModified": "2024-05-29T07:15:09.833",
  "metrics": {},
  "published": "2024-04-14T13:15:48.400",
  "references": [],
  "sourceIdentifier": "security@openanolis.org",
  "vulnStatus": "Rejected"
}

CNVD-2024-20270

Vulnerability from cnvd - Published: 2024-04-18

Title

Linux kernel存在未明漏洞（CNVD-2024-20270）

Description

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于函数pci1xxxx_spi_probe存在空指针取消引用漏洞。目前没有详细的漏洞细节提供。

Severity

低

Formal description

厂商尚未提供漏洞修复方案，请关注厂商主页更新： https://bugzilla.openanolis.cn/show_bug.cgi?id=8748

Reference

https://bugzilla.openanolis.cn/show_bug.cgi?id=8748

Impacted products

Name
Linux Linux kernel

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2024-24862",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-24862"
    }
  },
  "description": "Linux kernel\u662f\u7f8e\u56fdLinux\u57fa\u91d1\u4f1a\u7684\u5f00\u6e90\u64cd\u4f5c\u7cfb\u7edfLinux\u6240\u4f7f\u7528\u7684\u5185\u6838\u3002\n\nLinux kernel\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u51fd\u6570pci1xxxx_spi_probe\u5b58\u5728\u7a7a\u6307\u9488\u53d6\u6d88\u5f15\u7528\u6f0f\u6d1e\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002",
  "formalWay": "\u5382\u5546\u5c1a\u672a\u63d0\u4f9b\u6f0f\u6d1e\u4fee\u590d\u65b9\u6848\uff0c\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u66f4\u65b0\uff1a\r\nhttps://bugzilla.openanolis.cn/show_bug.cgi?id=8748",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2024-20270",
  "openTime": "2024-04-18",
  "products": {
    "product": "Linux Linux kernel"
  },
  "referenceLink": "https://bugzilla.openanolis.cn/show_bug.cgi?id=8748",
  "serverity": "\u4f4e",
  "submitTime": "2024-04-16",
  "title": "Linux kernel\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\uff08CNVD-2024-20270\uff09"
}

GSD-2024-24862

Vulnerability from gsd - Updated: 2024-02-02 06:02

Details

In function pci1xxxx_spi_probe, there is a potential null pointer that may be caused by a failed memory allocation by the function devm_kzalloc. Hence, a null pointer check needs to be added to prevent null pointer dereferencing later in the code. To fix this issue, spi_bus->spi_int[iter] should be checked. The memory allocated by devm_kzalloc will be automatically released, so just directly return -ENOMEM without worrying about memory leaks.

Aliases

CVE-2024-24862

JSON

To clipboard

{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-24862"
      ],
      "details": "In function pci1xxxx_spi_probe, there is a potential null pointer that\nmay be caused by a failed memory allocation by the function devm_kzalloc.\nHence, a null pointer check needs to be added to prevent null pointer\ndereferencing later in the code.\n\nTo fix this issue, spi_bus-\u003espi_int[iter] should be checked. The memory\nallocated by devm_kzalloc will be automatically released, so just directly\nreturn -ENOMEM without worrying about memory leaks.\n\n",
      "id": "GSD-2024-24862",
      "modified": "2024-02-02T06:02:55.482923Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@openanolis.org",
        "ID": "CVE-2024-24862",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Linux kernel",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "v6.2",
                          "version_value": "v6.9-rc3"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Linux"
            }
          ]
        }
      },
      "credits": [
        {
          "lang": "en",
          "value": "\u5218\u6000\u8fdc \u003cqq810974084@gmail.com\u003e"
        },
        {
          "lang": "en",
          "value": "\u767d\u5bb6\u9a79 \u003cbaijiaju@buaa.edu.cn\u003e"
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "In function pci1xxxx_spi_probe, there is a potential null pointer that\nmay be caused by a failed memory allocation by the function devm_kzalloc.\nHence, a null pointer check needs to be added to prevent null pointer\ndereferencing later in the code.\n\nTo fix this issue, spi_bus-\u003espi_int[iter] should be checked. The memory\nallocated by devm_kzalloc will be automatically released, so just directly\nreturn -ENOMEM without worrying about memory leaks.\n\n"
          }
        ]
      },
      "generator": {
        "engine": "Vulnogram 0.1.0-dev"
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-476",
                "lang": "eng",
                "value": "CWE-476 NULL Pointer Dereference"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://bugzilla.openanolis.cn/show_bug.cgi?id=8748",
            "refsource": "MISC",
            "url": "https://bugzilla.openanolis.cn/show_bug.cgi?id=8748"
          }
        ]
      },
      "solution": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?h=next-20240411\u0026amp;id=1f886a7bfb3faf4c1021e73f045538008ce7634e\"\u003ehttps://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?h=next-20240411\u0026amp;id=1...\u003c/a\u003e\u003cbr\u003e"
            }
          ],
          "value": " https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?h=next-20240411\u0026id=1... https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/ \n"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "descriptions": [
          {
            "lang": "en",
            "value": "In function pci1xxxx_spi_probe, there is a potential null pointer that\nmay be caused by a failed memory allocation by the function devm_kzalloc.\nHence, a null pointer check needs to be added to prevent null pointer\ndereferencing later in the code.\n\nTo fix this issue, spi_bus-\u003espi_int[iter] should be checked. The memory\nallocated by devm_kzalloc will be automatically released, so just directly\nreturn -ENOMEM without worrying about memory leaks.\n\n"
          },
          {
            "lang": "es",
            "value": "En la funci\u00f3n pci1xxxx_spi_probe, hay un posible puntero nulo que puede deberse a una asignaci\u00f3n de memoria fallida por parte de la funci\u00f3n devm_kzalloc. Por lo tanto, es necesario agregar una verificaci\u00f3n de puntero nulo para evitar que se elimine la referencia al puntero nulo m\u00e1s adelante en el c\u00f3digo. Para solucionar este problema, se debe marcar spi_bus-\u0026gt;spi_int[iter]. La memoria asignada por devm_kzalloc se liberar\u00e1 autom\u00e1ticamente, por lo que simplemente devuelva -ENOMEM directamente sin preocuparse por p\u00e9rdidas de memoria."
          }
        ],
        "id": "CVE-2024-24862",
        "lastModified": "2024-04-15T13:15:31.997",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 0.8,
              "impactScore": 4.0,
              "source": "security@openanolis.org",
              "type": "Secondary"
            }
          ]
        },
        "published": "2024-04-14T13:15:48.400",
        "references": [
          {
            "source": "security@openanolis.org",
            "url": "https://bugzilla.openanolis.cn/show_bug.cgi?id=8748"
          }
        ],
        "sourceIdentifier": "security@openanolis.org",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-476"
              }
            ],
            "source": "security@openanolis.org",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}

GHSA-FQ5M-XQJF-8M57

Vulnerability from github – Published: 2024-04-14 15:30 – Updated: 2024-04-14 15:30

Details

To fix this issue, spi_bus->spi_int[iter] should be checked. The memory allocated by devm_kzalloc will be automatically released, so just directly return -ENOMEM without worrying about memory leaks.

Severity ?

5.3 (Medium)


                  
                    CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-24862"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-14T13:15:48Z",
    "severity": "MODERATE"
  },
  "details": "In function pci1xxxx_spi_probe, there is a potential null pointer that\nmay be caused by a failed memory allocation by the function devm_kzalloc.\nHence, a null pointer check needs to be added to prevent null pointer\ndereferencing later in the code.\n\nTo fix this issue, spi_bus-\u003espi_int[iter] should be checked. The memory\nallocated by devm_kzalloc will be automatically released, so just directly\nreturn -ENOMEM without worrying about memory leaks.\n\n",
  "id": "GHSA-fq5m-xqjf-8m57",
  "modified": "2024-04-14T15:30:32Z",
  "published": "2024-04-14T15:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24862"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.openanolis.cn/show_bug.cgi?id=8748"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-24862 (GCVE-0-2024-24862)

FKIE_CVE-2024-24862

CNVD-2024-20270

GSD-2024-24862

GHSA-FQ5M-XQJF-8M57

Tags

Sightings

Nomenclature