Riskcovery

CVE-2024-49860

ACPI: sysfs: validate return type of _STR method

State
Published
Severity
7.3 High
Published
Oct 21, 2024
Updated
Aug 5, 2026
Reserved
Oct 21, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ACPI: sysfs: validate return type of _STR method

Only buffer objects are valid return values of _STR.

If something else is returned description_show() will access invalid memory.

Scores

CVSSScoreVectorSource
3.17.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • d1efe3c324ead77d3f6cd85093b50f6bd2e17aba to before 92fd5209fc014405f63a7db79802ca4b01dc0c05Affected
  • d1efe3c324ead77d3f6cd85093b50f6bd2e17aba to before 2364b6af90c6b6d8a4783e0d3481ca80af699554Affected
  • d1efe3c324ead77d3f6cd85093b50f6bd2e17aba to before 4b081991c4363e072e1748efed0bbec8a77daba5Affected
  • d1efe3c324ead77d3f6cd85093b50f6bd2e17aba to before 0cdfb9178a3bba843c95c2117c82c15f1a64b9ceAffected
  • d1efe3c324ead77d3f6cd85093b50f6bd2e17aba to before 5c8d007c14aefc3f2ddf71e4c40713733dc827beAffected
  • d1efe3c324ead77d3f6cd85093b50f6bd2e17aba to before f0921ecd4ddc14646bb5511f49db4d7d3b0829f0Affected
  • d1efe3c324ead77d3f6cd85093b50f6bd2e17aba to before f51e5a88f2e7224858b261546cf6b3037dfb1323Affected
  • d1efe3c324ead77d3f6cd85093b50f6bd2e17aba to before f51f711d36e61fbb87c67b524fd200e05172668dAffected
  • d1efe3c324ead77d3f6cd85093b50f6bd2e17aba to before 4bb1e7d027413835b086aed35bc3f0713bc0f72bAffected
LinuxLinux
  • 3.7Affected
  • before 3.7Not affected
  • 4.19.323 through 4.19.*Not affected
  • 5.4.285 through 5.4.*Not affected
  • 5.10.227 through 5.10.*Not affected
  • 5.15.168 through 5.15.*Not affected
  • 6.1.113 through 6.1.*Not affected
  • 6.6.54 through 6.6.*Not affected
  • 6.10.13 through 6.10.*Not affected
  • 6.11.2 through 6.11.*Not affected
  • 6.12 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.