CVE-2024-36975 Details
Description
In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Do not use WARN when encode fails When asn1_encode_sequence() fails, WARN is not the correct solution. 1. asn1_encode_sequence() is not an internal function (located in lib/asn1_encode.c). 2. Location is known, which makes the stack trace useless. 3. Results a crash if panic_on_warn is set. It is also noteworthy that the use of WARN is undocumented, and it should be avoided unless there is a carefully considered rationale to use it. Replace WARN with pr_err, and print the return value instead, which is only useful piece of information.
A vulnerability in the Linux kernel's handling of ASN.1 encoding for trusted keys can lead to a system crash if the 'panic_on_warn' option is enabled. The issue arises because the 'WARN' macro is used improperly when the 'asn1_encode_sequence' function fails. This function, which is not internal to the kernel, encounters an error that is known and can be traced, rendering the stack trace from the warning useless. The incorrect use of 'WARN' can cause a crash when 'panic_on_warn' is activated, as the warning is treated as a critical error. The 'WARN' usage is also undocumented and should be reserved for well-justified cases. This vulnerability affects Linux kernel versions 5.13 and later.
The vulnerability has been addressed by replacing the 'WARN' macro with 'pr_err', which logs the error without causing a crash. Users should upgrade to the latest version of the Linux kernel where this fix has been applied.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Sep 10, 2024References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.13, < 5.15.160 >= 5.16, < 6.1.92 >= 6.2, < 6.6.32 >= 6.7, < 6.8.11 >= 6.9, < 6.9.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 1, 2025 | Initial Analysis | [email protected] |
| Nov 21, 2024 | CVE Modified | CVE |
| Jun 18, 2024 | New CVE Received | kernel.org |