CVE-2024-20095
published 2024-10-07CVE-2024-20095: In m4u, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges…
PriorityP416medium4.4CVSS 3.1
AVLACLPRHUINSUCHINAN
EPSS
0.10%
1.0th percentile
In m4u, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08996894; Issue ID: MSV-1636.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2024-58075 kernel: crypto: tegra - do not transfer req when tegra init fails
bugzilla·2025-03-06·CVSS 5.5
CVE-2024-58075 [MEDIUM] CVE-2024-58075 kernel: crypto: tegra - do not transfer req when tegra init fails
CVE-2024-58075 kernel: crypto: tegra - do not transfer req when tegra init fails
In the Linux kernel, the following vulnerability has been resolved:
crypto: tegra - do not transfer req when tegra init fails
The tegra_cmac_init or tegra_sha_init function may return an error when
memory is exhausted. It should not transfer the request when they return
an error.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025030629-CVE-2024-58075-2f60@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 10
Via RHSA-2025:20095 https://access.redhat.com/errata/RHSA-2025:20095
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:20518 https://access.redhat.com/errata/RHSA-2025:20
Bugzilla
CVE-2024-58061 kernel: wifi: mac80211: prohibit deactivating all links
bugzilla·2025-03-06·CVSS 5.5
CVE-2024-58061 [MEDIUM] CVE-2024-58061 kernel: wifi: mac80211: prohibit deactivating all links
CVE-2024-58061 kernel: wifi: mac80211: prohibit deactivating all links
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: prohibit deactivating all links
In the internal API this calls this is a WARN_ON, but that
should remain since internally we want to know about bugs
that may cause this. Prevent deactivating all links in the
debugfs write directly.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025030608-CVE-2024-58061-80cf@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 10
Via RHSA-2025:20095 https://access.redhat.com/errata/RHSA-2025:20095
Bugzilla
CVE-2024-49570 kernel: drm/xe/tracing: Fix a potential TP_printk UAF
bugzilla·2025-02-27·CVSS 7.8
CVE-2024-49570 [HIGH] CVE-2024-49570 kernel: drm/xe/tracing: Fix a potential TP_printk UAF
CVE-2024-49570 kernel: drm/xe/tracing: Fix a potential TP_printk UAF
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/tracing: Fix a potential TP_printk UAF
The commit
afd2627f727b ("tracing: Check "%s" dereference via the field and not the TP_printk format")
exposes potential UAFs in the xe_bo_move trace event.
Fix those by avoiding dereferencing the
xe_mem_type_to_name[] array at TP_printk time.
Since some code refactoring has taken place, explicit backporting may
be needed for kernels older than 6.10.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025022601-CVE-2024-49570-d2e7@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 10
Via RHSA-2025:20095 https://access.redhat.com/erra
Bugzilla
CVE-2024-57988 kernel: Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name()
bugzilla·2025-02-27·CVSS 5.5
CVE-2024-57988 [MEDIUM] CVE-2024-57988 kernel: Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name()
CVE-2024-57988 kernel: Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name()
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name()
devm_kstrdup() can return a NULL pointer on failure,but this
returned value in btbcm_get_board_name() is not checked.
Add NULL check in btbcm_get_board_name(), to handle kernel NULL
pointer dereference error.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025022637-CVE-2024-57988-db3b@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 10
Via RHSA-2025:20095 https://access.redhat.com/errata/RHSA-2025:20095
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-
Bugzilla
CVE-2024-58014 kernel: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy()
bugzilla·2025-02-27·CVSS 7.1
CVE-2024-58014 [HIGH] CVE-2024-58014 kernel: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy()
CVE-2024-58014 kernel: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy()
In the Linux kernel, the following vulnerability has been resolved:
wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy()
In 'wlc_phy_iqcal_gainparams_nphy()', add gain range check to WARN()
instead of possible out-of-bounds 'tbl_iqcal_gainparams_nphy' access.
Compile tested only.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025022657-CVE-2024-58014-6269@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 10
Via RHSA-2025:20095 https://access.redhat.com/errata/RHSA-2025:20095
---
This issue has been addressed in the following prod
Bugzilla
CVE-2024-58020 kernel: HID: multitouch: Add NULL check in mt_input_configured
bugzilla·2025-02-27·CVSS 5.5
CVE-2024-58020 [MEDIUM] CVE-2024-58020 kernel: HID: multitouch: Add NULL check in mt_input_configured
CVE-2024-58020 kernel: HID: multitouch: Add NULL check in mt_input_configured
In the Linux kernel, the following vulnerability has been resolved:
HID: multitouch: Add NULL check in mt_input_configured
devm_kasprintf() can return a NULL pointer on failure,but this
returned value in mt_input_configured() is not checked.
Add NULL check in mt_input_configured(), to handle kernel NULL
pointer dereference error.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025022603-CVE-2024-58020-a097@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 10
Via RHSA-2025:20095 https://access.redhat.com/errata/RHSA-2025:20095
Bugzilla
CVE-2024-58015 kernel: wifi: ath12k: Fix for out-of bound access error
bugzilla·2025-02-27·CVSS 7.1
CVE-2024-58015 [HIGH] CVE-2024-58015 kernel: wifi: ath12k: Fix for out-of bound access error
CVE-2024-58015 kernel: wifi: ath12k: Fix for out-of bound access error
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath12k: Fix for out-of bound access error
Selfgen stats are placed in a buffer using print_array_to_buf_index() function.
Array length parameter passed to the function is too big, resulting in possible
out-of bound memory error.
Decreasing buffer size by one fixes faulty upper bound of passed array.
Discovered in coverity scan, CID 1600742 and CID 1600758
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025022657-CVE-2024-58015-f72e@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 10
Via RHSA-2025:20095 https://access.redhat.com/errata/RHSA-2025:20095
---
This issu
Bugzilla
CVE-2024-57987 kernel: Bluetooth: btrtl: check for NULL in btrtl_setup_realtek()
bugzilla·2025-02-27·CVSS 5.5
CVE-2024-57987 [MEDIUM] CVE-2024-57987 kernel: Bluetooth: btrtl: check for NULL in btrtl_setup_realtek()
CVE-2024-57987 kernel: Bluetooth: btrtl: check for NULL in btrtl_setup_realtek()
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btrtl: check for NULL in btrtl_setup_realtek()
If insert an USB dongle which chip is not maintained in ic_id_table, it
will hit the NULL point accessed. Add a null point check to avoid the
Kernel Oops.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025022637-CVE-2024-57987-09a3@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 10
Via RHSA-2025:20095 https://access.redhat.com/errata/RHSA-2025:20095
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:20518 https://access.redhat.com/errata/RHSA-2025:20
Bugzilla
CVE-2024-57989 kernel: wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links
bugzilla·2025-02-27·CVSS 5.5
CVE-2024-57989 [MEDIUM] CVE-2024-57989 kernel: wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links
CVE-2024-57989 kernel: wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links
In mt7925_change_vif_links() devm_kzalloc() may return NULL but this
returned value is not checked.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025022638-CVE-2024-57989-0a14@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 10
Via RHSA-2025:20095 https://access.redhat.com/errata/RHSA-2025:20095
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:20518 https://access.redhat.com/errata/RHSA-2025:20518
Bugzilla
CVE-2024-54456 kernel: NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client()
bugzilla·2025-02-27·CVSS 7.8
CVE-2024-54456 [HIGH] CVE-2024-54456 kernel: NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client()
CVE-2024-54456 kernel: NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client()
In the Linux kernel, the following vulnerability has been resolved:
NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client()
name is char[64] where the size of clnt->cl_program->name remains
unknown. Invoking strcat() directly will also lead to potential buffer
overflow. Change them to strscpy() and strncat() to fix potential
issues.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025022602-CVE-2024-54456-e8a9@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 10
Via RHSA-2025:20095 https://access.redhat.com/errata/RHSA-2025:20095
---
This issue has been addressed in the following products:
Red Hat Enterprise Linu
Bugzilla
CVE-2024-58012 kernel: ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params
bugzilla·2025-02-27·CVSS 5.5
CVE-2024-58012 [MEDIUM] CVE-2024-58012 kernel: ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params
CVE-2024-58012 kernel: ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params
Each cpu DAI should associate with a widget. However, the topology might
not create the right number of DAI widgets for aggregated amps. And it
will cause NULL pointer deference.
Check that the DAI widget associated with the CPU DAI is valid to prevent
NULL pointer deference due to missing DAI widgets in topologies with
aggregated amps.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025022656-CVE-2024-58012-90ce@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 10
Via RHSA-2025:20095 ht
Bugzilla
CVE-2024-52332 kernel: igb: Fix potential invalid memory access in igb_init_module()
bugzilla·2025-01-11·CVSS 7.1
CVE-2024-52332 [HIGH] CVE-2024-52332 kernel: igb: Fix potential invalid memory access in igb_init_module()
CVE-2024-52332 kernel: igb: Fix potential invalid memory access in igb_init_module()
In the Linux kernel, the following vulnerability has been resolved:
igb: Fix potential invalid memory access in igb_init_module()
The pci_register_driver() can fail and when this happened, the dca_notifier
needs to be unregistered, otherwise the dca_notifier can be called when
igb fails to install, resulting to invalid memory access.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025011122-CVE-2024-52332-9d2f@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 10
Via RHSA-2025:20095 https://access.redhat.com/errata/RHSA-2025:20095
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RH
2024-10-07
Published