PT-2024-20650 · Openeuler · Openeuler Kernel

[e-mail] + 1 · Published 2024-04-03 · Updated 2024-04-15 · CVE-2024-24898

Positive Technologies (AI Summary)

CVSS v3.1

6.0

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions openEuler kernel versions 4.19.90-2109.1.0.0108 through 4.19.90-2403.4.0.0244

Description The issue is related to Exposure of Sensitive Information to an Unauthorized Actor, allowing Resource Leak Exposure in the openEuler kernel on Linux. This vulnerability is associated with program files, specifically the tcm.C file in the drivers/staging/gmjstcm directory.

Recommendations To resolve the issue, update the kernel to a version later than 4.19.90-2403.4.0.0244. As a temporary workaround, consider restricting access to the vulnerable program files, specifically the tcm.C file in the drivers/staging/gmjstcm directory, until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-24898

OESA-2024-1358

Affected Products

Openeuler Kernel

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2024-24891 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-24898 · Security Note
• https://osv.dev/vulnerability/OESA-2024-1358 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-24898 · Security Note
• https://ubuntu.com/security/CVE-2024-24898 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-24898 · Vendor Advisory
• https://gitee.com/src-openeuler/kernel/pulls/1321 · Note
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1358 · Note
• https://gitee.com/openeuler/kernel/commit/c04a1c6afc6bca0fa5739ecf4f58e4723d82e82f · Note
• https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1358 · Note
• https://t.me/cvenotify/76795 · Telegram Post
• https://gitee.com/src-openeuler/kernel/pulls/1320 · Note
• https://twitter.com/CVEnew/status/1779853782261936320 · Twitter Post
• https://gitee.com/src-openeuler/kernel/pulls/1322 · Note