SECUFOCUSNOW
Home›CVE index›CVE-2024-46859
Review reviewHigh

CVE-2024-46859

Linux Linux, debian linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses The panasonic laptop code in various places uses the SINF array with index values of 0 - SINF_CUR_BRIGHT(0x0d) without checking that the SINF array is big enough. Not all panasonic laptops have this many SINF array entries, for example the Toughbook CF-18 model only has 10 SINF array entries. So it only supports the AC+DC brightness entries and mute. Check that the SINF array has a minimum size which covers all AC+DC brightness entries and refuse to load...

CVSS
7.8
EPSS
-
- percentile
CISA KEV
Not listed
Published
2024.09.27
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses The panasonic laptop code in various places uses the SINF array with index values of 0 - SINF_CUR_BRIGHT(0x0d) without checking that the SINF array is big enough. Not all panasonic laptops have this many SINF array entries, for example the Toughbook CF-18 model only has 10 SINF array entries. So it only supports the AC+DC brightness entries and mute. Check that the SINF array has a minimum size which covers all AC+DC brightness entries and refuse to load...

Affected product and versions

Product
Linux Linux, debian linux, linux kernel
Affected versions
>= e424fb8cc4e6634c10f8159b1ff5618cf7bab9c6 < b7c2f692307fe704be87ea80d7328782b33c3cef, >= e424fb8cc4e6634c10f8159b1ff5618cf7bab9c6 < 9291fadbd2720a869b1d2fcf82305648e2e62a16, >= e424fb8cc4e6634c10f8159b1ff5618cf7bab9c6 < 6821a82616f60aa72c5909b3e252ad97fb9f7e2a, >= e424fb8cc4e6634c10f8159b1ff5618cf7bab9c6 < b38c19783286a71693c2194ed1b36665168c09c4, >= e424fb8cc4e6634c10f8159b1ff5618cf7bab9c6 < f52e98d16e9bd7dd2b3aef8e38db5cbc9899d6a4, >= 3.3, 11.0, >= 3.3 < 5.15.168, >= 5.16 < 6.1.111, >= 6.2 < 6.6.52, >= 6.7 < 6.10.11, 6.11
Fixed versions
5.15.168, 6.1.111, 6.6.52, 6.10.11

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, debian linux, linux kernel and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-129