Lucene search

K
nvd416baaa9-dc9f-4396-8d5f-8c081fb06d67NVD:CVE-2024-36975
HistoryJun 18, 2024 - 8:15 p.m.

CVE-2024-36975

2024-06-1820:15:13
416baaa9-dc9f-4396-8d5f-8c081fb06d67
web.nvd.nist.gov
3
linux
kernel
vulnerability
keys
trusted
encode fails
warn
asn1_encode_sequence
crash
panic_on_warn
pr_err
stack trace

0.0004 Low

EPSS

Percentile

10.4%

In the Linux kernel, the following vulnerability has been resolved:

KEYS: trusted: Do not use WARN when encode fails

When asn1_encode_sequence() fails, WARN is not the correct solution.

  1. asn1_encode_sequence() is not an internal function (located
    in lib/asn1_encode.c).
  2. Location is known, which makes the stack trace useless.
  3. Results a crash if panic_on_warn is set.

It is also noteworthy that the use of WARN is undocumented, and it
should be avoided unless there is a carefully considered rationale to
use it.

Replace WARN with pr_err, and print the return value instead, which is
only useful piece of information.

0.0004 Low

EPSS

Percentile

10.4%

Related for NVD:CVE-2024-36975