7

CVE-2024-42228: linux Use of Uninitialized Resource

CVSS: 7.0v3.1HighModified
AliasesUBUNTU-CVE-2024-42228DEBIAN-CVE-2024-42228
Published 30-07-2024Last modified 11-05-2026
Open JSON

Vulnerability summary

CVE-2024-42228 is a high (CVSS 7.0) Use of Uninitialized Resource vulnerability in linux. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 14% of scored vulnerabilities.

Overall risk
28/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.0/10
010
High · v3.1 (NVD)
EPSS score
0.24%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 39 · Related 30
DLA-3912-1DLA-4008-1DSA-5782-1MGASA-2024-0277MGASA-2024-0278RHSA-2024:10771

Timeline

  1. 30-07-2024
    PublishedVulnerability first disclosed.
  2. 11-05-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc Initialize the size before calling amdgpu_vce_cs_reloc, such as case 0x03000001. V2: To really improve the handling we would actually need to have a separate value of 0xffffffff.(Christian)

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.24%

Chance of exploitation in the next 30 days

Percentile

14%

Versus all other CVEs

30-day change

0.00 pp

From 0.24% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.24%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu129 products
  • linux< 4.4.0-259.293 | < 4.15.0-229.241 | < 5.4.0-196.216 | < 5.15.0-122.132 | < 6.8.0-45.45
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 4.4.0-1136.142 | < 4.4.0-1174.189 | < 4.15.0-1173.186 | < 5.4.0-1133.143 | < 5.15.0-1070.76 | < 6.8.0-1016.17
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ d38ceaf99ed015f2a0b9af3499791bd3a3daae21, < d35cf41c8eb5d9fe95b21ae6ee2910f9ba4878e8 | ≥ d38ceaf99ed015f2a0b9af3499791bd3a3daae21, < 3b505759447637dcccb50cbd98ec6f8d2a04fc46 | ≥ d38ceaf99ed015f2a0b9af3499791bd3a3daae21, < df02642c21c984303fe34c3f7d72965792fb1a15 | ≥ d38ceaf99ed015f2a0b9af3499791bd3a3daae21, < da6a85d197888067e8d38b5d22c986b5b5cab712 | ≥ d38ceaf99ed015f2a0b9af3499791bd3a3daae21, < 9ee1534ecdd5b4c013064663502d7fde824d2144 | ≥ d38ceaf99ed015f2a0b9af3499791bd3a3daae21, < 855ae72c20310e5402b2317fc537d911e87537ef | ≥ d38ceaf99ed015f2a0b9af3499791bd3a3daae21, < f8f120b3de48b8b6bdf8988a9b334c2d61c17440 | ≥ d38ceaf99ed015f2a0b9af3499791bd3a3daae21, < 88a9a467c548d0b3c7761b4fd54a68e70f9c0944 | 4.2
  • linux_kernel< 6.6.39 | ≥ 6.7, < 6.9.9
Debian1 product
  • linux< 6.1.112-1 | < 6.9.9-1

3 vendors · 132 products

References

33 links
Show all 33 references