CVE-2024-41052

MEDIUM5.5

vfio/pci: Init the count variable in collecting hot-reset devices

Published Jul 29, 2024

Modified 8 months ago

No fix available

Details

In the Linux kernel, the following vulnerability has been resolved:

vfio/pci: Init the count variable in collecting hot-reset devices

The count variable is used without initialization, it results in mistakes in the device counting and crashes the userspace if the get hot reset info path is triggered.

References

WEBhttps://git.kernel.org/stable/c/5a88a3f67e37e39f933b38ebb4985ba5822e9eca WEBhttps://git.kernel.org/stable/c/f44136b9652291ac1fc39ca67c053ac624d0d11b WEBhttps://git.kernel.org/stable/c/f476dffc52ea70745dcabf63288e770e50ac9ab3 ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2024-41052

CVSS Analysis

CVSS v3.1

5.5

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

LowPR:L

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

NoneI:N

Availability

HighA:H

5.5/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Ecosystems

Timeline

PublishedJul 29, 2024

ModifiedMay 4, 2025

CVE-2024-41052 | Mondoo Vulnerability Intelligence