Riskcovery

CVE-2024-36975

KEYS: trusted: Do not use WARN when encode fails

State
Published
Severity
Not scored
Published
Jun 18, 2024
Updated
May 11, 2026
Reserved
May 30, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

KEYS: trusted: Do not use WARN when encode fails

When asn1_encode_sequence() fails, WARN is not the correct solution.

1. asn1_encode_sequence() is not an internal function (located in lib/asn1_encode.c). 2. Location is known, which makes the stack trace useless. 3. Results a crash if panic_on_warn is set.

It is also noteworthy that the use of WARN is undocumented, and it should be avoided unless there is a carefully considered rationale to use it.

Replace WARN with pr_err, and print the return value instead, which is only useful piece of information.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • f2219745250f388edacabe6cca73654131c67d0a to before 96f650995c70237b061b497c66755e32908f8972Affected
  • f2219745250f388edacabe6cca73654131c67d0a to before 681935009fec3fc22af97ee312d4a24ccf3cf087Affected
  • f2219745250f388edacabe6cca73654131c67d0a to before 1c652e1e10676f942149052d9329b8bf2703529aAffected
  • f2219745250f388edacabe6cca73654131c67d0a to before d32c6e09f7c4bec3ebc4941323f0aa6366bc1487Affected
  • f2219745250f388edacabe6cca73654131c67d0a to before ff91cc12faf798f573dab2abc976c1d5b1862feaAffected
  • f2219745250f388edacabe6cca73654131c67d0a to before 050bf3c793a07f96bd1e2fd62e1447f731ed733bAffected
LinuxLinux
  • 5.13Affected
  • before 5.13Not affected
  • 5.15.160 through 5.15.*Not affected
  • 6.1.92 through 6.1.*Not affected
  • 6.6.32 through 6.6.*Not affected
  • 6.8.11 through 6.8.*Not affected
  • 6.9.2 through 6.9.*Not affected
  • 6.10 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.