CVE-2024-49858Improper Restriction of Operations within the Bounds of a Memory Buffer in Linux

Severity
5.5MEDIUMNVD
OSV8.8
EPSS
0.0%
top 97.38%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedOct 21
Latest updateAug 14

Description

In the Linux kernel, the following vulnerability has been resolved: efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption The TPM event log table is a Linux specific construct, where the data produced by the GetEventLog() boot service is cached in memory, and passed on to the OS using an EFI configuration table. The use of EFI_LOADER_DATA here results in the region being left unreserved in the E820 memory map constructed by the EFI stub, and this is the memory description tha

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages14 packages

Patches

🔴Vulnerability Details

24
OSV
linux-azure-nvidia vulnerabilities2025-04-28
OSV
linux-azure-6.8 vulnerabilities2025-04-01
OSV
linux-hwe-6.8 vulnerabilities2025-04-01
OSV
linux-azure vulnerabilities2025-03-27
OSV
linux-oem-6.8 vulnerabilities2025-03-27

📋Vendor Advisories

26
CISA ICS
Siemens Third-Party Components in SINEC OS2025-08-14
Ubuntu
Linux kernel (Azure, N-Series) vulnerabilities2025-04-28
Ubuntu
Linux kernel (Azure) vulnerabilities2025-04-01
Ubuntu
Linux kernel (HWE) vulnerabilities2025-04-01
Ubuntu
Linux kernel (IBM) vulnerabilities2025-03-27