Vulnerability in Linux

CVE-2024-41056

In the Linux kernel, the following vulnerability has been resolved: firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files Use strnlen() instead of strlen() on the algorithm and coefficient name string arrays in V1 wmfw files. In V1 wmfw files the name is a NUL-terminated string in a fixed-size array. cs_dsp should protect against overrunning the array if the NUL terminator is missing.

Published · last modified .

CVSS v3 metric

CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H.

EPSS exploit prediction

EPSS: 0.003 (15.3th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 15th percentile — 15.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2024-41056: held from 0.003 to 0.003.

EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000

Affected products

  • Linux — versions f6bc909e7673c30abcbdb329e7d0aa2e83c103d7, 5.16, 0
  • Linux Kernel — versions 6.10

References

Frequently asked questions

What is CVE-2024-41056?
CVE-2024-41056 is a high-severity vulnerability in Linux. CVSS score: 7.3/10. Published 2024-07-29.
How severe is CVE-2024-41056?
High severity. CVSS v3 base score is 7.3 out of 10.