PT-2024-20647 · Openeuler · Openeuler Kernel

[e-mail] + 1 · Published 2024-04-03 · Updated 2024-04-15 · CVE-2024-24891

Positive Technologies (AI Summary)

CVSS v3.1

6.0

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions openEuler kernel versions 4.19.90-2109.1.0.0108 through 4.19.90-2403.4.0.0244

Description The issue allows exposure of sensitive information to an unauthorized actor, resulting in Resource Leak Exposure. This vulnerability is associated with program files at https://gitee.Com/openeuler/kernel/blob/openEuler-1.0-LTS/drivers/staging/gmjstcm/tcm.C.

Recommendations Upgrade the kernel to a patched version as soon as possible. Audit systems for signs of exploit attempts or unauthorized access. Notify stakeholders of the remediation plan.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-24891

OESA-2024-1358

Affected Products

Openeuler Kernel

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2024-24891 · Security Note
• https://osv.dev/vulnerability/OESA-2024-1358 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-24891 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-24898 · Security Note
• https://ubuntu.com/security/CVE-2024-24891 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-24891 · Vendor Advisory
• https://gitee.com/src-openeuler/kernel/pulls/1321 · Note
• https://t.me/cvenotify/76794 · Telegram Post
• https://gitee.com/openeuler/kernel/commit/c04a1c6afc6bca0fa5739ecf4f58e4723d82e82f · Note
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1358 · Note
• https://twitter.com/CVEnew/status/1779853783570559479 · Twitter Post
• https://gitee.com/openeuler/kernel/pulls/2810 · Note
• https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1358 · Note
• https://gitee.com/src-openeuler/kernel/pulls/1320 · Note
• https://twitter.com/oktsec/status/1779898194362556438 · Twitter Post