CVE-2024-41029
In the Linux kernel, the following vulnerability has been resolved: nvmem: core: limit cell sysfs permissions to main attribute ones The cell sysfs attribute should not provide more access to the nvmem data than the main attribute itself.
Does this matter?
Lower severity and a low EPSS score (0.27%). Track it; it rarely justifies an emergency change on its own.
Description
In the Linux kernel, the following vulnerability has been resolved: nvmem: core: limit cell sysfs permissions to main attribute ones The cell sysfs attribute should not provide more access to the nvmem data than the main attribute itself. For example if nvme_config::root_only was set, the cell attribute would still provide read access to everybody. Mask out permissions not available on the main attribute.
- CVSS 3.1
- 5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.27% probability · 19th percentile
- CISA KEV
- Not listed
- Affected
- linux/linux kernel
- Source
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
References
- https://git.kernel.org/stable/c/6bef98bafd82903a8d461463f9594f19f1fd6a85Patch
- https://git.kernel.org/stable/c/aa066afaaac32caf2160d58d4e3010ee04421c62Patch
- https://git.kernel.org/stable/c/6bef98bafd82903a8d461463f9594f19f1fd6a85Patch
- https://git.kernel.org/stable/c/aa066afaaac32caf2160d58d4e3010ee04421c62Patch
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.