CVE-2024-49973 (GCVE-0-2024-49973)
Vulnerability from cvelistv5
Published
2024-10-21 18:02
Modified
2026-08-05 11:40
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: r8169: add tally counter fields added with RTL8125 RTL8125 added fields to the tally counter, what may result in the chip dma'ing these new fields to unallocated memory. Therefore make sure that the allocated memory area is big enough to hold all of the tally counter values, even if we use only parts of it.
References
Impacted products
Vendor Product Version
Linux Linux Version: f1bce4ad2f1cee6759711904b9fffe4a3dd8af87
Version: f1bce4ad2f1cee6759711904b9fffe4a3dd8af87
Version: f1bce4ad2f1cee6759711904b9fffe4a3dd8af87
Version: f1bce4ad2f1cee6759711904b9fffe4a3dd8af87
Version: f1bce4ad2f1cee6759711904b9fffe4a3dd8af87
Version: f1bce4ad2f1cee6759711904b9fffe4a3dd8af87
Version: f1bce4ad2f1cee6759711904b9fffe4a3dd8af87
Version: f1bce4ad2f1cee6759711904b9fffe4a3dd8af87
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-49973",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:33:30.477812Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:38:45.854Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:23:53.307Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCM-/XRM-/XCH-/XRH-300 family",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:13:50.940Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-355557.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/realtek/r8169_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "64648ae8c97ec5a3165021627f5a1658ebe081ca",
              "status": "affected",
              "version": "f1bce4ad2f1cee6759711904b9fffe4a3dd8af87",
              "versionType": "git"
            },
            {
              "lessThan": "991e8b0bab669b7d06927c3e442b3352532e8581",
              "status": "affected",
              "version": "f1bce4ad2f1cee6759711904b9fffe4a3dd8af87",
              "versionType": "git"
            },
            {
              "lessThan": "21950321ad33d7613b1453f4c503d7b1871deb61",
              "status": "affected",
              "version": "f1bce4ad2f1cee6759711904b9fffe4a3dd8af87",
              "versionType": "git"
            },
            {
              "lessThan": "fe44b3bfbf0c74df5712f44458689d0eccccf47d",
              "status": "affected",
              "version": "f1bce4ad2f1cee6759711904b9fffe4a3dd8af87",
              "versionType": "git"
            },
            {
              "lessThan": "1c723d785adb711496bc64c24240f952f4faaabf",
              "status": "affected",
              "version": "f1bce4ad2f1cee6759711904b9fffe4a3dd8af87",
              "versionType": "git"
            },
            {
              "lessThan": "92bc8647b4d65f4d4bf8afdb206321c1bc55a486",
              "status": "affected",
              "version": "f1bce4ad2f1cee6759711904b9fffe4a3dd8af87",
              "versionType": "git"
            },
            {
              "lessThan": "585c048d15ed559f20cb94c8fa2f30077efa4fbc",
              "status": "affected",
              "version": "f1bce4ad2f1cee6759711904b9fffe4a3dd8af87",
              "versionType": "git"
            },
            {
              "lessThan": "ced8e8b8f40accfcce4a2bbd8b150aa76d5eff9a",
              "status": "affected",
              "version": "f1bce4ad2f1cee6759711904b9fffe4a3dd8af87",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/realtek/r8169_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.4"
            },
            {
              "lessThan": "5.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.285",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.227",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.285",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.227",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.168",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.113",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.55",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.14",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.3",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nr8169: add tally counter fields added with RTL8125\n\nRTL8125 added fields to the tally counter, what may result in the chip\ndma\u0027ing these new fields to unallocated memory. Therefore make sure\nthat the allocated memory area is big enough to hold all of the\ntally counter values, even if we use only parts of it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The out-of-bounds DMA occurs only when the host issues a CounterDump, which is initiated locally via `/proc/net/dev`, sysfs `statistics/`, `ip -s link`, or `ETHTOOL_GSTATS` \u2014 a LAN attacker can shape the overflowing counter values but cannot initiate the dump. Reaching the code therefore requires local access.\nAC:L - No race, timing window, or memory-layout precondition exists; a single unprivileged stats read deterministically triggers the 128-byte overflow, and it can be repeated at will in a loop.\nPR:L - Any unprivileged local user can trigger it \u2014 `/proc/net/dev` and `/sys/class/net/*/statistics/*` require no capability, and `ETHTOOL_GSTATS` is explicitly exempt from the `CAP_NET_ADMIN` check in `__dev_ethtool()` (net/ethtool/ioctl.c:3093), so it works even from inside an unprivileged container.\nUI:N - The attacker triggers the counter dump entirely on their own by reading interface statistics; no victim action is needed.\nS:U - The overflow corrupts kernel-owned memory within the same security authority and does not violate an IOMMU translation or cross a VM/sandbox boundary.\nC:H - A 128-byte device-DMA write past the allocation corrupts adjacent kernel memory that can hold pointers, lengths, or other metadata, and such corruption is leveragable into arbitrary kernel memory disclosure.\nI:H - This is a 128-byte out-of-bounds write performed by the NIC\u0027s DMA engine, invisible to KASAN/SLUB redzoning, and an adjacent-network attacker can influence the written values through the rx_octets/rx_pause/rx_runt/rx_mac_error tally fields \u2014 a partially controlled OOB write primitive.\nA:H - Repeated DMA writes into memory the kernel may have allocated for other purposes corrupt live kernel state, leading to oops or panic, and the attacker can trigger the write continuously."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:40:47.240Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/64648ae8c97ec5a3165021627f5a1658ebe081ca"
        },
        {
          "url": "https://git.kernel.org/stable/c/991e8b0bab669b7d06927c3e442b3352532e8581"
        },
        {
          "url": "https://git.kernel.org/stable/c/21950321ad33d7613b1453f4c503d7b1871deb61"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe44b3bfbf0c74df5712f44458689d0eccccf47d"
        },
        {
          "url": "https://git.kernel.org/stable/c/1c723d785adb711496bc64c24240f952f4faaabf"
        },
        {
          "url": "https://git.kernel.org/stable/c/92bc8647b4d65f4d4bf8afdb206321c1bc55a486"
        },
        {
          "url": "https://git.kernel.org/stable/c/585c048d15ed559f20cb94c8fa2f30077efa4fbc"
        },
        {
          "url": "https://git.kernel.org/stable/c/ced8e8b8f40accfcce4a2bbd8b150aa76d5eff9a"
        }
      ],
      "title": "r8169: add tally counter fields added with RTL8125",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-49973",
    "datePublished": "2024-10-21T18:02:21.696Z",
    "dateReserved": "2024-10-21T12:17:06.051Z",
    "dateUpdated": "2026-08-05T11:40:47.240Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:23:53.307Z\"}}, {\"affected\": [{\"vendor\": \"Siemens\", \"product\": \"RUGGEDCOM RST2428P\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SCALANCE XCM-/XRM-/XCH-/XRH-300 family\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"x_adpType\": \"supplier\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-265688.html\"}, {\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-355557.html\"}], \"providerMetadata\": {\"orgId\": \"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\", \"shortName\": \"siemens-SADP\", \"dateUpdated\": \"2026-05-12T12:13:50.940Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-49973\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-22T13:33:30.477812Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-22T13:33:34.088Z\"}}], \"cna\": {\"title\": \"r8169: add tally counter fields added with RTL8125\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The out-of-bounds DMA occurs only when the host issues a CounterDump, which is initiated locally via `/proc/net/dev`, sysfs `statistics/`, `ip -s link`, or `ETHTOOL_GSTATS` \\u2014 a LAN attacker can shape the overflowing counter values but cannot initiate the dump. Reaching the code therefore requires local access.\\nAC:L - No race, timing window, or memory-layout precondition exists; a single unprivileged stats read deterministically triggers the 128-byte overflow, and it can be repeated at will in a loop.\\nPR:L - Any unprivileged local user can trigger it \\u2014 `/proc/net/dev` and `/sys/class/net/*/statistics/*` require no capability, and `ETHTOOL_GSTATS` is explicitly exempt from the `CAP_NET_ADMIN` check in `__dev_ethtool()` (net/ethtool/ioctl.c:3093), so it works even from inside an unprivileged container.\\nUI:N - The attacker triggers the counter dump entirely on their own by reading interface statistics; no victim action is needed.\\nS:U - The overflow corrupts kernel-owned memory within the same security authority and does not violate an IOMMU translation or cross a VM/sandbox boundary.\\nC:H - A 128-byte device-DMA write past the allocation corrupts adjacent kernel memory that can hold pointers, lengths, or other metadata, and such corruption is leveragable into arbitrary kernel memory disclosure.\\nI:H - This is a 128-byte out-of-bounds write performed by the NIC\u0027s DMA engine, invisible to KASAN/SLUB redzoning, and an adjacent-network attacker can influence the written values through the rx_octets/rx_pause/rx_runt/rx_mac_error tally fields \\u2014 a partially controlled OOB write primitive.\\nA:H - Repeated DMA writes into memory the kernel may have allocated for other purposes corrupt live kernel state, leading to oops or panic, and the attacker can trigger the write continuously.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"f1bce4ad2f1cee6759711904b9fffe4a3dd8af87\", \"lessThan\": \"64648ae8c97ec5a3165021627f5a1658ebe081ca\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f1bce4ad2f1cee6759711904b9fffe4a3dd8af87\", \"lessThan\": \"991e8b0bab669b7d06927c3e442b3352532e8581\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f1bce4ad2f1cee6759711904b9fffe4a3dd8af87\", \"lessThan\": \"21950321ad33d7613b1453f4c503d7b1871deb61\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f1bce4ad2f1cee6759711904b9fffe4a3dd8af87\", \"lessThan\": \"fe44b3bfbf0c74df5712f44458689d0eccccf47d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f1bce4ad2f1cee6759711904b9fffe4a3dd8af87\", \"lessThan\": \"1c723d785adb711496bc64c24240f952f4faaabf\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f1bce4ad2f1cee6759711904b9fffe4a3dd8af87\", \"lessThan\": \"92bc8647b4d65f4d4bf8afdb206321c1bc55a486\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f1bce4ad2f1cee6759711904b9fffe4a3dd8af87\", \"lessThan\": \"585c048d15ed559f20cb94c8fa2f30077efa4fbc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f1bce4ad2f1cee6759711904b9fffe4a3dd8af87\", \"lessThan\": \"ced8e8b8f40accfcce4a2bbd8b150aa76d5eff9a\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/realtek/r8169_main.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.4\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.4\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.285\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.227\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.168\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.113\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.55\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.14\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/realtek/r8169_main.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/64648ae8c97ec5a3165021627f5a1658ebe081ca\"}, {\"url\": \"https://git.kernel.org/stable/c/991e8b0bab669b7d06927c3e442b3352532e8581\"}, {\"url\": \"https://git.kernel.org/stable/c/21950321ad33d7613b1453f4c503d7b1871deb61\"}, {\"url\": \"https://git.kernel.org/stable/c/fe44b3bfbf0c74df5712f44458689d0eccccf47d\"}, {\"url\": \"https://git.kernel.org/stable/c/1c723d785adb711496bc64c24240f952f4faaabf\"}, {\"url\": \"https://git.kernel.org/stable/c/92bc8647b4d65f4d4bf8afdb206321c1bc55a486\"}, {\"url\": \"https://git.kernel.org/stable/c/585c048d15ed559f20cb94c8fa2f30077efa4fbc\"}, {\"url\": \"https://git.kernel.org/stable/c/ced8e8b8f40accfcce4a2bbd8b150aa76d5eff9a\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nr8169: add tally counter fields added with RTL8125\\n\\nRTL8125 added fields to the tally counter, what may result in the chip\\ndma\u0027ing these new fields to unallocated memory. Therefore make sure\\nthat the allocated memory area is big enough to hold all of the\\ntally counter values, even if we use only parts of it.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.285\", \"versionStartIncluding\": \"5.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.227\", \"versionStartIncluding\": \"5.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.168\", \"versionStartIncluding\": \"5.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.113\", \"versionStartIncluding\": \"5.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.55\", \"versionStartIncluding\": \"5.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.14\", \"versionStartIncluding\": \"5.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.3\", \"versionStartIncluding\": \"5.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"5.4\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:40:47.240Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-49973\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:40:47.240Z\", \"dateReserved\": \"2024-10-21T12:17:06.051Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T18:02:21.696Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.