CVE-2024-46836 — Improper Validation of Array Index in Linux

CWE-129 — Improper Validation of Array Index16 documents7 sources
Severity
7.8HIGHNVD
OSV5.5
EPSS
0.0%
top 97.18%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
8
LinuxLinux KernelDebian Linux+5 more
Timeline
PublishedSep 27
Latest updateJan 9

Description

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeed_udc: validate endpoint index for ast udc We should verify the bound of the array to assure that host may not manipulate the index to point past endpoint array. Found by static analysis.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages10 packages

▶NVDlinux/linux_kernel6.2 — 6.6.51+2
▶Debianlinux/linux_kernel< 6.1.112-1+2
▶Ubuntulinux/linux_kernel< 6.8.0-50.51

Patches

Patch: git.kernel.org ↗Patch: git.kernel.org ↗Patch: git.kernel.org ↗

🔴Vulnerability Details

7
OSV
linux-azure, linux-azure-6.8 vulnerabilities↗2025-01-09
▶
OSV
linux-hwe-6.8 vulnerabilities↗2025-01-06
▶
OSV
linux-gkeop vulnerabilities↗2024-12-12
▶
OSV
linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency vulnerabilities↗2024-12-12
▶
OSV
linux, linux-aws, linux-aws-6.8, linux-gcp, linux-gcp-6.8, linux-gke, linux-ibm, linux-lowlatency, linux-lowlatency-hwe-6.8, linux-oem-6.8, linux-oracle, linux-oracle-6.8, linux-raspi vulnerabilities↗2024-12-12
▶

📋Vendor Advisories

8
Ubuntu
Linux kernel (Azure) vulnerabilities↗2025-01-09
▶
Ubuntu
Linux kernel (HWE) vulnerabilities↗2025-01-06
▶
Ubuntu
Linux kernel (GKE) vulnerabilities↗2024-12-12
▶
Ubuntu
Linux kernel (NVIDIA) vulnerabilities↗2024-12-12
▶
Ubuntu
Linux kernel vulnerabilities↗2024-12-12
▶
CVE-2024-46836 — Improper Validation of Array Index | cvebase