CVE-2024-41028: linux Improper Validation of Array Index

Vulnerability summary

CVE-2024-41028 is a high (CVSS 7.8) Improper Validation of Array Index vulnerability in linux. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21.3% of scored vulnerabilities.

Timeline

1. 29-07-2024
   PublishedVulnerability first disclosed.
2. 05-08-2026
   Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: platform/x86: toshiba_acpi: Fix array out-of-bounds access In order to use toshiba_dmi_quirks[] together with the standard DMI matching functions, it must be terminated by a empty entry. Since this entry is missing, an array out-of-bounds access occurs every time the quirk list is processed. Fix this by adding the terminating empty entry.

• CWE-129Improper Validation of Array IndexThe product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.