CVE-2024-49961

5.5 · MEDIUM

Published Oct 21, 2024 linux EPSS 0.24% (14th pctl) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Overview

CVE-2024-49961 is a medium-severity vulnerability affecting linux linux_kernel. It was published on October 21, 2024 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

media: i2c: ar0521: Use cansleep version of gpiod_set_value()

If we use GPIO reset from I2C port expander, we must use *_cansleep()

variant of GPIO functions.

This was not done in ar0521_power_on()/ar0521_power_off() functions.

Let's fix that.

------------[ cut here ]------------

WARNING: CPU: 0 PID: 11 at drivers/gpio/gpiolib.c:3496 gpiod_set_value+0x74/0x7c

Modules linked in:

CPU: 0 PID: 11 Comm: kworker/u16:0 Not tainted 6.10.0 #53

Hardware name: Diasom DS-RK3568-SOM-EVB (DT)

Workqueue: events_unbound deferred_probe_work_func

pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)

pc : gpiod_set_value+0x74/0x7c

lr : ar0521_power_on+0xcc/0x290

sp : ffffff8001d7ab70

x29: ffffff8001d7ab70 x28: ffffff80027dcc90 x27: ffffff8003c82000

x26: ffffff8003ca9250 x25: ffffffc080a39c60 x24: ffffff8003ca9088

x23: ffffff8002402720 x22: ffffff8003ca9080 x21: ffffff8003ca9088

x20: 0000000000000000 x19: ffffff8001eb2a00 x18

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

Vendor	Product	Versions	Status
linux	linux_kernel	>= 6.0, < 6.1.113	Affected

References

Ref git.kernel.org/stable/c/2423b60a2d6d27e5f66c5021b494463aef2db212 Ref git.kernel.org/stable/c/3cf00ecfbf11ee8e6afff306a5bdcff4bf95d2cf Ref git.kernel.org/stable/c/625a77b68c96349c16fcc1faa42784313e0b1a85 Ref git.kernel.org/stable/c/9f08876d766755a92f1b9543ae3ee21bfc596fb8 Ref git.kernel.org/stable/c/bee1aed819a8cda47927436685d216906ed17f62 Ref lists.debian.org/debian-lts-announce/2025/01/msg00001.html

Frequently Asked Questions

What is CVE-2024-49961?

CVE-2024-49961 is a medium-severity vulnerability affecting linux linux_kernel. It was published on October 21, 2024 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2024-49961?

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2024-49961?

How can CyberStrike help with CVE-2024-49961?

CyberStrike's AI-powered security agents can automatically detect CVE-2024-49961 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.

How CyberStrike Helps

Autonomous Discovery

AI agents map your attack surface to find vulnerabilities like this one.

Continuous Pentesting

Automated penetration testing that runs continuously, not just quarterly.

Code Review

AI-driven PR review catches vulnerable dependencies before they ship.

HackBrowser

Browser-based exploitation validates findings with real proof-of-concept.

Related MEDIUM CVEs from 2024

View all →

6.9

CVE-2023-3726

OCSInventory allow stored email template with special characters that lead to a Stored cross-site Sc

6.9

CVE-2023-51719