CVE-2024-36975

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-36975

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Do not use WARN when encode fails When asn1_encode_sequence() fails, WARN is not the correct solution. 1. asn1_encode_sequence() is not an internal function (located in lib/asn1_encode.c). 2. Location is known, which makes the stack trace useless. 3. Results a crash if panic_on_warn is set. It is also noteworthy that the use of WARN is undocumented, and it should be avoided unless there is a carefully considered rationale to use it. Replace WARN with pr_err, and print the return value instead, which is only useful piece of information.

References
Link Resource
https://git.kernel.org/stable/c/050bf3c793a07f96bd1e2fd62e1447f731ed733b Patch
https://git.kernel.org/stable/c/1c652e1e10676f942149052d9329b8bf2703529a Patch
https://git.kernel.org/stable/c/681935009fec3fc22af97ee312d4a24ccf3cf087 Patch
https://git.kernel.org/stable/c/96f650995c70237b061b497c66755e32908f8972 Patch
https://git.kernel.org/stable/c/d32c6e09f7c4bec3ebc4941323f0aa6366bc1487 Patch
https://git.kernel.org/stable/c/ff91cc12faf798f573dab2abc976c1d5b1862fea Patch
https://git.kernel.org/stable/c/050bf3c793a07f96bd1e2fd62e1447f731ed733b Patch
https://git.kernel.org/stable/c/1c652e1e10676f942149052d9329b8bf2703529a Patch
https://git.kernel.org/stable/c/681935009fec3fc22af97ee312d4a24ccf3cf087 Patch
https://git.kernel.org/stable/c/96f650995c70237b061b497c66755e32908f8972 Patch
https://git.kernel.org/stable/c/d32c6e09f7c4bec3ebc4941323f0aa6366bc1487 Patch
https://git.kernel.org/stable/c/ff91cc12faf798f573dab2abc976c1d5b1862fea Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

01 Oct 2025, 15:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CWE NVD-CWE-noinfo
References () https://git.kernel.org/stable/c/050bf3c793a07f96bd1e2fd62e1447f731ed733b - () https://git.kernel.org/stable/c/050bf3c793a07f96bd1e2fd62e1447f731ed733b - Patch
References () https://git.kernel.org/stable/c/1c652e1e10676f942149052d9329b8bf2703529a - () https://git.kernel.org/stable/c/1c652e1e10676f942149052d9329b8bf2703529a - Patch
References () https://git.kernel.org/stable/c/681935009fec3fc22af97ee312d4a24ccf3cf087 - () https://git.kernel.org/stable/c/681935009fec3fc22af97ee312d4a24ccf3cf087 - Patch
References () https://git.kernel.org/stable/c/96f650995c70237b061b497c66755e32908f8972 - () https://git.kernel.org/stable/c/96f650995c70237b061b497c66755e32908f8972 - Patch
References () https://git.kernel.org/stable/c/d32c6e09f7c4bec3ebc4941323f0aa6366bc1487 - () https://git.kernel.org/stable/c/d32c6e09f7c4bec3ebc4941323f0aa6366bc1487 - Patch
References () https://git.kernel.org/stable/c/ff91cc12faf798f573dab2abc976c1d5b1862fea - () https://git.kernel.org/stable/c/ff91cc12faf798f573dab2abc976c1d5b1862fea - Patch
First Time Linux
Linux linux Kernel

21 Nov 2024, 09:22

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/050bf3c793a07f96bd1e2fd62e1447f731ed733b - () https://git.kernel.org/stable/c/050bf3c793a07f96bd1e2fd62e1447f731ed733b -
References () https://git.kernel.org/stable/c/1c652e1e10676f942149052d9329b8bf2703529a - () https://git.kernel.org/stable/c/1c652e1e10676f942149052d9329b8bf2703529a -
References () https://git.kernel.org/stable/c/681935009fec3fc22af97ee312d4a24ccf3cf087 - () https://git.kernel.org/stable/c/681935009fec3fc22af97ee312d4a24ccf3cf087 -
References () https://git.kernel.org/stable/c/96f650995c70237b061b497c66755e32908f8972 - () https://git.kernel.org/stable/c/96f650995c70237b061b497c66755e32908f8972 -
References () https://git.kernel.org/stable/c/d32c6e09f7c4bec3ebc4941323f0aa6366bc1487 - () https://git.kernel.org/stable/c/d32c6e09f7c4bec3ebc4941323f0aa6366bc1487 -
References () https://git.kernel.org/stable/c/ff91cc12faf798f573dab2abc976c1d5b1862fea - () https://git.kernel.org/stable/c/ff91cc12faf798f573dab2abc976c1d5b1862fea -

20 Jun 2024, 12:44

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: LLAVES: confiable: no usar WARN cuando falla la codificación Cuando falla asn1_encode_sequence(), WARN no es la solución correcta. 1. asn1_encode_sequence() no es una función interna (ubicada en lib/asn1_encode.c). 2. Se conoce la ubicación, lo que hace que el seguimiento de la pila sea inútil. 3. Se produce un bloqueo si se configura pánico_on_warn. También es digno de mención que el uso de WARN no está documentado y debe evitarse a menos que exista una justificación cuidadosamente considerada para su uso. Reemplace WARN con pr_err e imprima el valor de retorno, que es solo información útil.

18 Jun 2024, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-18 20:15

Updated : 2025-10-01 15:16

NVD link : CVE-2024-36975

Mitre link : CVE-2024-36975

CVE.ORG link : CVE-2024-36975

JSON object : View

Products Affected

linux

CWE
NVD-CWE-noinfo