PT-2024-32237 · Linux · Linux Kernel

Boris Brezillon + 1 · Published 2024-09-03 · Updated 2024-10-09 · CVE-2024-46837

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to the drm/panthor component, where high priorities on group create were not properly restricted. This allowed any users to create a high priority group without permission checks, potentially leading to denial of service. The fix now only allows the DRM master or users with the CAP SYS NICE capability to set higher priorities than PANTHOR GROUP PRIORITY MEDIUM.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2025-05934

CVE-2024-46837

Affected Products

Linux Kernel

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/46xxx/CVE-2024-46837.json · Exploit
• https://osv.dev/vulnerability/BELL-CVE-2024-46837 · Vendor Advisory
• https://git.kernel.org/stable/c/33eb0344e186a2bcc257c6c5a6e65c1cb42adb4a · Patch
• https://osv.dev/vulnerability/CVE-2024-46837 · Vendor Advisory
• https://git.kernel.org/stable/c/5f7762042f8a5377bd8a32844db353c0311a7369 · Patch
• https://cve.org/CVERecord?id=CVE-2024-46837 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-46837 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-46837 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-46837 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-46837 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-05934 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-46837 · Security Note
• https://git.kernel.org/linus/5f7762042f8a5377bd8a32844db353c0311a7369 · Note
• https://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.10.10 · Note
• https://twitter.com/CVEnew/status/1839659124260540520 · Twitter Post