GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-49862 (GCVE-0-2024-49862)

Vulnerability from cvelistv5 – Published: 2024-10-21 12:27 – Updated: 2026-08-05 11:40
VLAI
Title
powercap: intel_rapl: Fix off by one in get_rpi()
Summary
In the Linux kernel, the following vulnerability has been resolved: powercap: intel_rapl: Fix off by one in get_rpi() The rp->priv->rpi array is either rpi_msr or rpi_tpmi which have NR_RAPL_PRIMITIVES number of elements. Thus the > needs to be >= to prevent an off by one access.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-21 12:54 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 98ff639a7289067247b3ef9dd5d1e922361e7365 , < 288cbc505e2046638c615c36357cb78bc9fee1e0 (git)
Affected: 98ff639a7289067247b3ef9dd5d1e922361e7365 , < 851e7f7f14a15f4e47b7d0f70d5c4a2b95b824d6 (git)
Affected: 98ff639a7289067247b3ef9dd5d1e922361e7365 , < 6a34f3b0d7f11fb6ed72da315fd2360abd9c0737 (git)
Affected: 98ff639a7289067247b3ef9dd5d1e922361e7365 , < 95f6580352a7225e619551febb83595bcb77ab17 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.5
Unaffected: 0 , < 6.5 (semver)
Unaffected: 6.6.54 , ≤ 6.6.* (semver)
Unaffected: 6.10.13 , ≤ 6.10.* (semver)
Unaffected: 6.11.2 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-49862",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-21T12:54:50.217091Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-21T12:55:35.960Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/powercap/intel_rapl_common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "288cbc505e2046638c615c36357cb78bc9fee1e0",
              "status": "affected",
              "version": "98ff639a7289067247b3ef9dd5d1e922361e7365",
              "versionType": "git"
            },
            {
              "lessThan": "851e7f7f14a15f4e47b7d0f70d5c4a2b95b824d6",
              "status": "affected",
              "version": "98ff639a7289067247b3ef9dd5d1e922361e7365",
              "versionType": "git"
            },
            {
              "lessThan": "6a34f3b0d7f11fb6ed72da315fd2360abd9c0737",
              "status": "affected",
              "version": "98ff639a7289067247b3ef9dd5d1e922361e7365",
              "versionType": "git"
            },
            {
              "lessThan": "95f6580352a7225e619551febb83595bcb77ab17",
              "status": "affected",
              "version": "98ff639a7289067247b3ef9dd5d1e922361e7365",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/powercap/intel_rapl_common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.54",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.13",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.2",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowercap: intel_rapl: Fix off by one in get_rpi()\n\nThe rp-\u003epriv-\u003erpi array is either rpi_msr or rpi_tpmi which have\nNR_RAPL_PRIMITIVES number of elements.  Thus the \u003e needs to be \u003e=\nto prevent an off by one access."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - intel_rapl is an x86 power-capping driver exposed solely through the local powercap sysfs class (/sys/class/powercap/intel-rapl:*) and in-kernel perf/PMU callbacks; there is no network or remote-peer input path.\nAC:L - The code path is entered by a simple, deterministic sysfs read with no race, no timing window, and no memory-layout dependency the attacker must first arrange.\nPR:L - The constraint_N_* attributes reaching get_rpi() are created 0644 (S_IWUSR|S_IRUGO) in seed_constraint_attributes(), so any unprivileged local user can drive get_current_power_limit() \u2192 rapl_read_pl_data() \u2192 get_rpi(); only the write side needs root.\nUI:N - Reading a sysfs file is fully attacker-driven; no victim action, mount, or file open by another user is needed.\nS:U - Both the faulty bounds check and any resulting memory access stay entirely within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The off-by-one yields an out-of-bounds read of a full struct rapl_primitive_info past rpi_msr/rpi_tpmi, whose unvalidated -\u003eid then indexes rd-\u003eregs[] out of bounds and produces a register handle that is read and returned to userspace through world-readable sysfs \u2014 an unbounded disclosure chain, not a few-byte bounded read.\nI:N - The unprivileged-reachable path is read-only; rapl_read_data_raw() writes nothing to kernel memory, and the only OOB-influenced register write lives behind root-only sysfs store handlers.\nA:H - An out-of-range rpi-\u003eid feeding rd-\u003eregs[] can yield a garbage MMIO handle that tpmi_rapl_read_raw() dereferences with a bare readq() behind only a NULL check, producing an oops and kernel crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:40:11.029Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/288cbc505e2046638c615c36357cb78bc9fee1e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/851e7f7f14a15f4e47b7d0f70d5c4a2b95b824d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a34f3b0d7f11fb6ed72da315fd2360abd9c0737"
        },
        {
          "url": "https://git.kernel.org/stable/c/95f6580352a7225e619551febb83595bcb77ab17"
        }
      ],
      "title": "powercap: intel_rapl: Fix off by one in get_rpi()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-49862",
    "datePublished": "2024-10-21T12:27:19.981Z",
    "dateReserved": "2024-10-21T12:17:06.017Z",
    "dateUpdated": "2026-08-05T11:40:11.029Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-49862",
      "date": "2026-09-16",
      "epss": "0.00227",
      "percentile": "0.13536"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.5\", \"versionEndExcluding\": \"6.6.54\", \"matchCriteriaId\": \"533A887F-F2B4-4445-8C73-11A8013D0A01\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.10.13\", \"matchCriteriaId\": \"CE94BB8D-B0AB-4563-9ED7-A12122B56EBE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.11\", \"versionEndExcluding\": \"6.11.2\", \"matchCriteriaId\": \"AB755D26-97F4-43B6-8604-CD076811E181\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\npowercap: intel_rapl: Fix off by one in get_rpi()\\n\\nThe rp-\u003epriv-\u003erpi array is either rpi_msr or rpi_tpmi which have\\nNR_RAPL_PRIMITIVES number of elements.  Thus the \u003e needs to be \u003e=\\nto prevent an off by one access.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: powercap: intel_rapl: Arreglo de un byte en get_rpi() La matriz rp-\u0026gt;priv-\u0026gt;rpi es rpi_msr o rpi_tpmi, que tienen una cantidad de elementos NR_RAPL_PRIMITIVES. Por lo tanto, el \u0026gt; debe ser \u0026gt;= para evitar un acceso de un byte.\"}]",
      "id": "CVE-2024-49862",
      "lastModified": "2024-10-23T16:53:51.050",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.2}]}",
      "published": "2024-10-21T13:15:06.893",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/288cbc505e2046638c615c36357cb78bc9fee1e0\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/6a34f3b0d7f11fb6ed72da315fd2360abd9c0737\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/851e7f7f14a15f4e47b7d0f70d5c4a2b95b824d6\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/95f6580352a7225e619551febb83595bcb77ab17\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-193\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T01:02:28.000Z",
      "cve": "CVE-2024-49862",
      "id": "msrc_CVE-2024-49862",
      "initial_release_date": "2024-10-01T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "powercap: intel_rapl: Fix off by one in get_rpi()",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-49862.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-49862\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T13:15:06.893\",\"lastModified\":\"2026-08-04T11:20:52.803\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\npowercap: intel_rapl: Fix off by one in get_rpi()\\n\\nThe rp-\u003epriv-\u003erpi array is either rpi_msr or rpi_tpmi which have\\nNR_RAPL_PRIMITIVES number of elements.  Thus the \u003e needs to be \u003e=\\nto prevent an off by one access.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: powercap: intel_rapl: Arreglo de un byte en get_rpi() La matriz rp-\u0026gt;priv-\u0026gt;rpi es rpi_msr o rpi_tpmi, que tienen una cantidad de elementos NR_RAPL_PRIMITIVES. Por lo tanto, el \u0026gt; debe ser \u0026gt;= para evitar un acceso de un byte.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/powercap/intel_rapl_common.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"98ff639a7289067247b3ef9dd5d1e922361e7365\",\"lessThan\":\"288cbc505e2046638c615c36357cb78bc9fee1e0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"98ff639a7289067247b3ef9dd5d1e922361e7365\",\"lessThan\":\"851e7f7f14a15f4e47b7d0f70d5c4a2b95b824d6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"98ff639a7289067247b3ef9dd5d1e922361e7365\",\"lessThan\":\"6a34f3b0d7f11fb6ed72da315fd2360abd9c0737\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"98ff639a7289067247b3ef9dd5d1e922361e7365\",\"lessThan\":\"95f6580352a7225e619551febb83595bcb77ab17\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/powercap/intel_rapl_common.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.54\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.13\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.2\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-21T12:54:50.217091Z\",\"id\":\"CVE-2024-49862\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-193\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.5\",\"versionEndExcluding\":\"6.6.54\",\"matchCriteriaId\":\"533A887F-F2B4-4445-8C73-11A8013D0A01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.13\",\"matchCriteriaId\":\"CE94BB8D-B0AB-4563-9ED7-A12122B56EBE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.2\",\"matchCriteriaId\":\"AB755D26-97F4-43B6-8604-CD076811E181\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/288cbc505e2046638c615c36357cb78bc9fee1e0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6a34f3b0d7f11fb6ed72da315fd2360abd9c0737\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/851e7f7f14a15f4e47b7d0f70d5c4a2b95b824d6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/95f6580352a7225e619551febb83595bcb77ab17\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T09:55:12+00:00",
      "cve": "CVE-2024-49862",
      "id": "CVE-2024-49862",
      "initial_release_date": "2024-10-21T00:00:00+00:00",
      "product_status:fixed": "305",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: powercap: intel_rapl: Fix off by one in get_rpi()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-49862.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T00:30:07Z",
      "cve": "CVE-2024-49862",
      "id": "CVE-2024-49862",
      "initial_release_date": "2024-10-21T15:45:29Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "443",
      "product_status:recommended": "410",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-49862",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-49862.json",
      "version": "63"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-49862\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-21T12:54:50.217091Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-21T12:55:29.871Z\"}}], \"cna\": {\"title\": \"powercap: intel_rapl: Fix off by one in get_rpi()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"98ff639a7289067247b3ef9dd5d1e922361e7365\", \"lessThan\": \"288cbc505e2046638c615c36357cb78bc9fee1e0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"98ff639a7289067247b3ef9dd5d1e922361e7365\", \"lessThan\": \"851e7f7f14a15f4e47b7d0f70d5c4a2b95b824d6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"98ff639a7289067247b3ef9dd5d1e922361e7365\", \"lessThan\": \"6a34f3b0d7f11fb6ed72da315fd2360abd9c0737\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"98ff639a7289067247b3ef9dd5d1e922361e7365\", \"lessThan\": \"95f6580352a7225e619551febb83595bcb77ab17\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/powercap/intel_rapl_common.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.5\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.5\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.54\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/powercap/intel_rapl_common.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/288cbc505e2046638c615c36357cb78bc9fee1e0\"}, {\"url\": \"https://git.kernel.org/stable/c/851e7f7f14a15f4e47b7d0f70d5c4a2b95b824d6\"}, {\"url\": \"https://git.kernel.org/stable/c/6a34f3b0d7f11fb6ed72da315fd2360abd9c0737\"}, {\"url\": \"https://git.kernel.org/stable/c/95f6580352a7225e619551febb83595bcb77ab17\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\npowercap: intel_rapl: Fix off by one in get_rpi()\\n\\nThe rp-\u003epriv-\u003erpi array is either rpi_msr or rpi_tpmi which have\\nNR_RAPL_PRIMITIVES number of elements.  Thus the \u003e needs to be \u003e=\\nto prevent an off by one access.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.54\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.13\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.2\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"6.5\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:39:47.618Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-49862\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T09:39:47.618Z\", \"dateReserved\": \"2024-10-21T12:17:06.017Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T12:27:19.981Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.