CVE-2024-46702

5.5 · MEDIUM

Published Sep 13, 2024 linux EPSS 0.24% (15th pctl) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Overview

CVE-2024-46702 is a medium-severity vulnerability affecting linux linux_kernel. It was published on September 13, 2024 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Mark XDomain as unplugged when router is removed

I noticed that when we do discrete host router NVM upgrade and it gets

hot-removed from the PCIe side as a result of NVM firmware authentication,

if there is another host connected with enabled paths we hang in tearing

them down. This is due to fact that the Thunderbolt networking driver

also tries to cleanup the paths and ends up blocking in

tb_disconnect_xdomain_paths() waiting for the domain lock.

However, at this point we already cleaned the paths in tb_stop() so

there is really no need for tb_disconnect_xdomain_paths() to do that

anymore. Furthermore it already checks if the XDomain is unplugged and

bails out early so take advantage of that and mark the XDomain as

unplugged when we remove the parent router.

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

Vendor	Product	Versions	Status
linux	linux_kernel	>= 0, < 5.10.225	Affected

References

Ref git.kernel.org/stable/c/18b3ad2a3cc877dd4b16f48d84aa27b78d53bf1d Ref git.kernel.org/stable/c/23ce6ba3b95488a2b9e9f6d43b340da0c15395dc Ref git.kernel.org/stable/c/747bc154577de6e6af4bc99abfa859b8419bb4d8 Ref git.kernel.org/stable/c/7ca24cf9163c112bb6b580c6fb57c04a1f8b76e1 Ref git.kernel.org/stable/c/80ac8d194831eca0c2f4fd862f7925532fda320c Ref git.kernel.org/stable/c/e2006140ad2e01a02ed0aff49cc2ae3ceeb11f8d Ref lists.debian.org/debian-lts-announce/2024/10/msg00003.html Ref lists.debian.org/debian-lts-announce/2025/01/msg00001.html

Frequently Asked Questions

What is CVE-2024-46702?

CVE-2024-46702 is a medium-severity vulnerability affecting linux linux_kernel. It was published on September 13, 2024 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2024-46702?

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2024-46702?

How can CyberStrike help with CVE-2024-46702?

CyberStrike's AI-powered security agents can automatically detect CVE-2024-46702 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.

How CyberStrike Helps

Autonomous Discovery

AI agents map your attack surface to find vulnerabilities like this one.

Continuous Pentesting

Automated penetration testing that runs continuously, not just quarterly.

Code Review

AI-driven PR review catches vulnerable dependencies before they ship.

HackBrowser

Browser-based exploitation validates findings with real proof-of-concept.

Related MEDIUM CVEs from 2024

View all →

6.9

CVE-2023-3726

OCSInventory allow stored email template with special characters that lead to a Stored cross-site Sc

6.9

CVE-2023-51719