PT-2024-31309 · Linux+8 · Linux Kernel+8
Hagar Hemdan
·
Published
2024-05-23
·
Updated
2025-09-29
·
CVE-2024-44931
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The issue allows userspace to trigger a speculative read of an address outside the gpio descriptor array by calling
gpio ioctl() with an offset out of range. The offset is copied from user and then used as an array index to get the gpio descriptor without sanitization in gpio device get desc(). This change ensures that the offset is sanitized by using array index nospec() to mitigate any possibility of speculative information leaks.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Hat
Red Os
Suse
Ubuntu