Resource exhaustion in Linux
CVE-2024-42242
In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci: Fix max_seg_size for 64KiB PAGE_SIZE blk_queue_max_segment_size() ensured: if (max_size < PAGE_SIZE) max_size = PAGE_SIZE; whereas: blk_validate_limits() makes it an error: if (WARN_ON_ONCE(lim->max_segment_size < PAGE_SIZE)) return -EINVAL; The change from one to the other, exposed sdhci which was setting maximum segment size too low in some circumstances. Fix the maximum segment size when it is too low.
EPSS: 0.002 (8.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Linux — versions 616f8766179277324393f7b77e07f14cb3503825, 6.9, 0
- Linux Linux_kernel
Weakness classification (CWE)
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2024-42242?
- CVE-2024-42242 is a medium-severity vulnerability in Linux, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 5.5/10. Published 2024-08-07.
- How severe is CVE-2024-42242?
- Medium severity. CVSS v3 base score is 5.5 out of 10.
- Is CVE-2024-42242 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.