Improper Check for Unusual or Exceptional Conditions Affecting kernel package, versions <0:4.14.345-262.561.amzn2
Threat Intelligence
EPSS
0.04% (6th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-AMZN2-KERNEL-7711004
- published 20 Aug 2024
- disclosed 12 Feb 2024
Introduced: 12 Feb 2024
CVE-2024-25739 Open this link in a new tabHow to fix?
Upgrade Amazon-Linux:2 kernel to version 0:4.14.345-262.561.amzn2 or higher.
This issue was patched in ALAS2-2024-2615.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kernel package and not the kernel package as distributed by Amazon-Linux.
See How to fix? for Amazon-Linux:2 relevant fixed versions and status.
create_empty_lvol in drivers/mtd/ubi/vtbl.c in the Linux kernel through 6.7.4 can attempt to allocate zero bytes, and crash, because of a missing check for ubi->leb_size.
References
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25739
- https://groups.google.com/g/syzkaller/c/Xl97YcQA4hg
- https://www.spinics.net/lists/kernel/msg5074816.html
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=68a24aba7c593eafa8fd00f2f76407b9b32b47a9
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
CVSS Scores
version 3.1