PT-2024-7181 · Linux+6 · Linux Kernel+6

Ma Ke

·

Published

2024-06-27

·

Updated

2026-05-26

·

CVE-2024-46836

CVSS v3.1

7.8

High

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)
Description The issue is related to the ast udc getstatus() function in the aspeed udc module of the Linux kernel's USB gadget driver. It involves incorrect index calculation, which could allow an attacker to impact the confidentiality, integrity, and availability of protected information. The problem arises from the lack of validation of the endpoint index, potentially allowing a host to manipulate the index to point past the endpoint array.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Improper Validation of Array Index

Weakness Enumeration

CWE-129

Related Identifiers

ALSA-2025_16880
ALT-PU-2024-13979
ALT-PU-2024-14046
BDU:2024-08520
CVE-2024-46836
DLA-4008-1
DSA-5782-1
OESA-2024-2296
OPENSUSE-SU-2024_3984-1
OPENSUSE-SU-2024_3986-1
SUSE-SU-2024:3984-1
SUSE-SU-2024:3986-1
SUSE-SU-2024:4318-1
SUSE-SU-2024:4387-1
SUSE-SU-2025:20163-1
SUSE-SU-2025:20164-1
SUSE-SU-2025:20246-1
SUSE-SU-2025:20247-1
USN-7154-1
USN-7154-2
USN-7155-1
USN-7156-1
USN-7196-1

Affected Products

Alt Linux
Astra Linux
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu