CVE-2024-44960
Last modified
CVE-2024-44960 is a medium-severity vulnerability rated 5.5/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: usb: gadget: core: Check for unset descriptor Make sure the descriptor has been set before looking at maxpacket. This fixes a null pointer panic in this case. This may happen if the gadget doesn't properly set up the endpoint for the current speed, or the gadget descriptors are malformed and the descriptor for the speed/endpoint are not found. No current gadget driver is known to have this problem, but this may cause a hard-to-find bug during development of new gadgets.. EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: core: Check for unset descriptor Make sure the descriptor has been set before looking at maxpacket. This fixes a null pointer panic in this case. This may happen if the gadget doesn't properly set up the endpoint for the current speed, or the gadget descriptors are malformed and the descriptor for the speed/endpoint are not found. No current gadget driver is known to have this problem, but this may cause a hard-to-find bug during development of new gadgets.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Linux | Linux Kernel | < 3.16.80 | — |
| Linux | Linux Kernel | >= 3.17, < 4.4.199 | — |
| Linux | Linux Kernel | >= 4.5, < 4.9.199 | — |
| Linux | Linux Kernel | >= 4.10, < 4.14.152 | — |
| Linux | Linux Kernel | >= 4.15, < 4.19.320 | — |
| Linux | Linux Kernel | >= 4.20, < 5.3.9 | — |
| Linux | Linux Kernel | >= 5.4, < 5.4.282 | — |
| Linux | Linux Kernel | >= 5.5, < 5.10.224 | — |
| Linux | Linux Kernel | >= 5.11, < 5.15.165 | — |
| Linux | Linux Kernel | >= 5.16, < 6.1.105 | — |
| Linux | Linux Kernel | >= 6.2, < 6.6.46 | — |
| Linux | Linux Kernel | >= 6.7, < 6.10.5 | — |
| Linux | Linux Kernel | 6.11 | Rc1 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2024-44960?
How severe is CVE-2024-44960?
How do I fix CVE-2024-44960?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-44955Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2024-44956In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2024-44957In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2024-44958In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2024-44959In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2024-4496A vulnerability was found in Tenda i21 1.0.0.14(4656). It ha…8.8
- CVE-2024-44961In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2024-44962In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2024-44963In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2024-44964In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2024-44965In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2024-44966In the Linux kernel, the following vulnerability has been re…5.5
Are you affected by CVE-2024-44960?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST