Linux: Uncontrolled Resource Consumption
CVE-2024-39462 is a critical-severity uncontrolled resource consumption vulnerability in Linux, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 0dc913217fb79096597005bba9ba738e2db5cd02, a1dd92fca0d6b58b55ed0484f75d4205dbb77010, 9368cdf90f52a68120d039887ccff74ff33b4444 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.76% chance of exploitation within 30 days, higher than 56% of scored CVEs.
Critical severity: a successful attack would have severe impact.
What to do
- Update Linux to 0dc913217fb79096597005bba9ba738e2db5cd02 or a1dd92fca0d6b58b55ed0484f75d4205dbb77010 or 9368cdf90f52a68120d039887ccff74ff33b4444, whichever matches your release line, or a later version.
- Update linux_kernel to 0dc913217fb7 or a1dd92fca0d6 or 9368cdf90f52, whichever matches your release line, or a later version.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | f316cdff8d677db9ad9c90acb44c4cd535b0ee27 up to, but not including, 0dc913217fb79096597005bba9ba738e2db5cd02; f316cdff8d677db9ad9c90acb44c4cd535b0ee27 up to, but not including, a1dd92fca0d6b58b55ed0484f75d4205dbb77010; f316cdff8d677db9ad9c90acb44c4cd535b0ee27 up to, but not including, 9368cdf90f52a68120d039887ccff74ff33b4444; 6.6 | 0dc913217fb79096597005bba9ba738e2db5cd02, a1dd92fca0d6b58b55ed0484f75d4205dbb77010, 9368cdf90f52a68120d039887ccff74ff33b4444 |
| Linux | linux_kernel | 6.6; f316cdff8d67 up to, but not including, 0dc913217fb7; f316cdff8d67 up to, but not including, a1dd92fca0d6; f316cdff8d67 up to, but not including, 9368cdf90f52 | 0dc913217fb7, a1dd92fca0d6, 9368cdf90f52 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CISA (ADP).
Official description
In the Linux kernel, the following vulnerability has been resolved: clk: bcm: dvp: Assign ->num before accessing ->hws Commit f316cdff8d67 ("clk: Annotate struct clk_hw_onecell_data with __counted_by") annotated the hws member of 'struct clk_hw_onecell_data' with __counted_by, which informs the bounds sanitizer about the number of elements in hws, so that it can warn when hws is accessed out of bounds. As noted in that change, the __counted_by member must be initialized with the number of elements before the first array access happens, otherwise there will be a warning from each access prior to the initialization because the number of elements is zero. This occurs in clk_dvp_probe() due to ->num being assigned after ->hws has been accessed: UBSAN: array-index-out-of-bounds in drivers/clk/bcm/clk-bcm2711-dvp.c:59:2 index 0 is out of range for type 'struct clk_hw *[] __counted_by(num)' (aka 'struct clk_hw *[]') Move the ->num initialization to before the first access of ->hws, which clears up the warning.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource.
How developers prevent this class of flaw
- Ensure that protocols have specific limits of scale placed on them.
- Ensure that all failures in resource allocation place the system into a safe posture.
More Uncontrolled Resource Consumption vulnerabilities (CWE-400)
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
Recent Uncontrolled Resource Consumption vulnerabilities
- 7.5 High severity
- 7.5 High severity
- 7.5 High severity
- 7.5 High severity
- 7.8 High severity
- 7.5 High severity
Spotted an error? Tell us.