cve-2024-46859
Vulnerability from cvelistv5
Published
2024-09-27 12:42
Modified
2024-12-19 09:24
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses The panasonic laptop code in various places uses the SINF array with index values of 0 - SINF_CUR_BRIGHT(0x0d) without checking that the SINF array is big enough. Not all panasonic laptops have this many SINF array entries, for example the Toughbook CF-18 model only has 10 SINF array entries. So it only supports the AC+DC brightness entries and mute. Check that the SINF array has a minimum size which covers all AC+DC brightness entries and refuse to load if the SINF array is smaller. For higher SINF indexes hide the sysfs attributes when the SINF array does not contain an entry for that attribute, avoiding show()/store() accessing the array out of bounds and add bounds checking to the probe() and resume() code accessing these.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6821a82616f60aa72c5909b3e252ad97fb9f7e2aPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9291fadbd2720a869b1d2fcf82305648e2e62a16Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b38c19783286a71693c2194ed1b36665168c09c4Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b7c2f692307fe704be87ea80d7328782b33c3cef
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f52e98d16e9bd7dd2b3aef8e38db5cbc9899d6a4Patch
Impacted products
Vendor Product Version
Linux Linux Version: e424fb8cc4e6634c10f8159b1ff5618cf7bab9c6
Version: e424fb8cc4e6634c10f8159b1ff5618cf7bab9c6
Version: e424fb8cc4e6634c10f8159b1ff5618cf7bab9c6
Version: e424fb8cc4e6634c10f8159b1ff5618cf7bab9c6
Version: e424fb8cc4e6634c10f8159b1ff5618cf7bab9c6
 Create a notification for this product.
   Linux Linux Version: 3.3
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-46859",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T13:57:08.389850Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-29T13:57:13.392Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/platform/x86/panasonic-laptop.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b7c2f692307fe704be87ea80d7328782b33c3cef",
              "status": "affected",
              "version": "e424fb8cc4e6634c10f8159b1ff5618cf7bab9c6",
              "versionType": "git"
            },
            {
              "lessThan": "9291fadbd2720a869b1d2fcf82305648e2e62a16",
              "status": "affected",
              "version": "e424fb8cc4e6634c10f8159b1ff5618cf7bab9c6",
              "versionType": "git"
            },
            {
              "lessThan": "6821a82616f60aa72c5909b3e252ad97fb9f7e2a",
              "status": "affected",
              "version": "e424fb8cc4e6634c10f8159b1ff5618cf7bab9c6",
              "versionType": "git"
            },
            {
              "lessThan": "b38c19783286a71693c2194ed1b36665168c09c4",
              "status": "affected",
              "version": "e424fb8cc4e6634c10f8159b1ff5618cf7bab9c6",
              "versionType": "git"
            },
            {
              "lessThan": "f52e98d16e9bd7dd2b3aef8e38db5cbc9899d6a4",
              "status": "affected",
              "version": "e424fb8cc4e6634c10f8159b1ff5618cf7bab9c6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/platform/x86/panasonic-laptop.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.3"
            },
            {
              "lessThan": "3.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: panasonic-laptop: Fix SINF array out of bounds accesses\n\nThe panasonic laptop code in various places uses the SINF array with index\nvalues of 0 - SINF_CUR_BRIGHT(0x0d) without checking that the SINF array\nis big enough.\n\nNot all panasonic laptops have this many SINF array entries, for example\nthe Toughbook CF-18 model only has 10 SINF array entries. So it only\nsupports the AC+DC brightness entries and mute.\n\nCheck that the SINF array has a minimum size which covers all AC+DC\nbrightness entries and refuse to load if the SINF array is smaller.\n\nFor higher SINF indexes hide the sysfs attributes when the SINF array\ndoes not contain an entry for that attribute, avoiding show()/store()\naccessing the array out of bounds and add bounds checking to the probe()\nand resume() code accessing these."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T09:24:53.586Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b7c2f692307fe704be87ea80d7328782b33c3cef"
        },
        {
          "url": "https://git.kernel.org/stable/c/9291fadbd2720a869b1d2fcf82305648e2e62a16"
        },
        {
          "url": "https://git.kernel.org/stable/c/6821a82616f60aa72c5909b3e252ad97fb9f7e2a"
        },
        {
          "url": "https://git.kernel.org/stable/c/b38c19783286a71693c2194ed1b36665168c09c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/f52e98d16e9bd7dd2b3aef8e38db5cbc9899d6a4"
        }
      ],
      "title": "platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-46859",
    "datePublished": "2024-09-27T12:42:49.801Z",
    "dateReserved": "2024-09-11T15:12:18.291Z",
    "dateUpdated": "2024-12-19T09:24:53.586Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-46859\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-09-27T13:15:17.430\",\"lastModified\":\"2024-10-17T14:15:13.183\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nplatform/x86: panasonic-laptop: Fix SINF array out of bounds accesses\\n\\nThe panasonic laptop code in various places uses the SINF array with index\\nvalues of 0 - SINF_CUR_BRIGHT(0x0d) without checking that the SINF array\\nis big enough.\\n\\nNot all panasonic laptops have this many SINF array entries, for example\\nthe Toughbook CF-18 model only has 10 SINF array entries. So it only\\nsupports the AC+DC brightness entries and mute.\\n\\nCheck that the SINF array has a minimum size which covers all AC+DC\\nbrightness entries and refuse to load if the SINF array is smaller.\\n\\nFor higher SINF indexes hide the sysfs attributes when the SINF array\\ndoes not contain an entry for that attribute, avoiding show()/store()\\naccessing the array out of bounds and add bounds checking to the probe()\\nand resume() code accessing these.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: plataforma/x86: panasonic-laptop: Arreglar accesos fuera de los l\u00edmites a la matriz SINF El c\u00f3digo de la computadora port\u00e1til Panasonic en varios lugares usa la matriz SINF con valores de \u00edndice de 0 - SINF_CUR_BRIGHT(0x0d) sin verificar que la matriz SINF sea lo suficientemente grande. No todas las computadoras port\u00e1tiles Panasonic tienen esta cantidad de entradas de matriz SINF, por ejemplo, el modelo Toughbook CF-18 solo tiene 10 entradas de matriz SINF. Por lo tanto, solo admite las entradas de brillo AC+DC y silencio. Verifique que la matriz SINF tenga un tama\u00f1o m\u00ednimo que cubra todas las entradas de brillo AC+DC y reh\u00fase a cargar si la matriz SINF es m\u00e1s peque\u00f1a. Para \u00edndices SINF m\u00e1s altos, oculte los atributos sysfs cuando la matriz SINF no contenga una entrada para ese atributo, evitando que show()/store() acceda a la matriz fuera de los l\u00edmites y agregue verificaci\u00f3n de los l\u00edmites al c\u00f3digo probe() y resume() que accede a estos.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-129\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.3\",\"versionEndExcluding\":\"6.1.111\",\"matchCriteriaId\":\"13A8DD15-8AC8-4B6B-8C25-2D4CD4636B39\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.52\",\"matchCriteriaId\":\"02ADDA94-95BB-484D-8E95-63C0428A28E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.11\",\"matchCriteriaId\":\"F5DB5367-F1F5-4200-B3B3-FDF8AFC3D255\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B3CE743-2126-47A3-8B7C-822B502CF119\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DEB27E7-30AA-45CC-8934-B89263EF3551\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0005AEF-856E-47EB-BFE4-90C46899394D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"39889A68-6D34-47A6-82FC-CD0BF23D6754\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8383ABF-1457-401F-9B61-EE50F4C61F4F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"B77A9280-37E6-49AD-B559-5B23A3B1DC3D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE5298B3-04B4-4F3E-B186-01A58B5C75A6\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/6821a82616f60aa72c5909b3e252ad97fb9f7e2a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9291fadbd2720a869b1d2fcf82305648e2e62a16\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b38c19783286a71693c2194ed1b36665168c09c4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b7c2f692307fe704be87ea80d7328782b33c3cef\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f52e98d16e9bd7dd2b3aef8e38db5cbc9899d6a4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-46859\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-29T13:57:08.389850Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-29T13:57:09.568Z\"}}], \"cna\": {\"title\": \"platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"e424fb8cc4e6\", \"lessThan\": \"b7c2f692307f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e424fb8cc4e6\", \"lessThan\": \"9291fadbd272\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e424fb8cc4e6\", \"lessThan\": \"6821a82616f6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e424fb8cc4e6\", \"lessThan\": \"b38c19783286\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e424fb8cc4e6\", \"lessThan\": \"f52e98d16e9b\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/platform/x86/panasonic-laptop.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.3\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.3\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"5.15.168\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.111\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.52\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.11\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/platform/x86/panasonic-laptop.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/b7c2f692307fe704be87ea80d7328782b33c3cef\"}, {\"url\": \"https://git.kernel.org/stable/c/9291fadbd2720a869b1d2fcf82305648e2e62a16\"}, {\"url\": \"https://git.kernel.org/stable/c/6821a82616f60aa72c5909b3e252ad97fb9f7e2a\"}, {\"url\": \"https://git.kernel.org/stable/c/b38c19783286a71693c2194ed1b36665168c09c4\"}, {\"url\": \"https://git.kernel.org/stable/c/f52e98d16e9bd7dd2b3aef8e38db5cbc9899d6a4\"}], \"x_generator\": {\"engine\": \"bippy-c9c4e1df01b2\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nplatform/x86: panasonic-laptop: Fix SINF array out of bounds accesses\\n\\nThe panasonic laptop code in various places uses the SINF array with index\\nvalues of 0 - SINF_CUR_BRIGHT(0x0d) without checking that the SINF array\\nis big enough.\\n\\nNot all panasonic laptops have this many SINF array entries, for example\\nthe Toughbook CF-18 model only has 10 SINF array entries. So it only\\nsupports the AC+DC brightness entries and mute.\\n\\nCheck that the SINF array has a minimum size which covers all AC+DC\\nbrightness entries and refuse to load if the SINF array is smaller.\\n\\nFor higher SINF indexes hide the sysfs attributes when the SINF array\\ndoes not contain an entry for that attribute, avoiding show()/store()\\naccessing the array out of bounds and add bounds checking to the probe()\\nand resume() code accessing these.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-10-17T13:48:20.152Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-46859\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-10-17T13:48:20.152Z\", \"dateReserved\": \"2024-09-11T15:12:18.291Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-27T12:42:49.801Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.