Vulnerability in Linux

CVE-2024-58077

In the Linux kernel, the following vulnerability has been resolved: ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback commit 1f5664351410 ("ASoC: lower "no backend DAIs enabled for ... Port" log severity") ignores -EINVAL error message on common soc_pcm_ret(). It is used from many functions, ignoring -EINVAL is over-kill. The reason why -EINVAL was ignored was it really should only be used upon invalid parameters coming from userspace and in that case we don't want to log an error since we do not want to give userspace a way to do a denial-of-service attack on the syslog / diskspace. So don't use soc_pcm_ret() on .prepare callback is better idea.

Published · last modified .

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

EPSS: 0.002 (7.1th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 7th percentile — 7.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2024-58077: held from 0.002 to 0.002.

EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: +0.000

Affected products

  • Linux — versions 1f566435141047ca7db26aa4b0b6647a25badaee, 6.5, 0
  • Linux Kernel — versions 6.5

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2024-58077?
CVE-2024-58077 is a medium-severity vulnerability in Linux. CVSS score: 5.5/10. Published 2025-03-06.
How severe is CVE-2024-58077?
Medium severity. CVSS v3 base score is 5.5 out of 10.
Is CVE-2024-58077 known to be exploited?
2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.