CVE-2024-40975

5.5 · MEDIUM

Published Jul 12, 2024 linux EPSS 0.29% (21th pctl) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Overview

CVE-2024-40975 is a medium-severity vulnerability affecting linux linux_kernel. It was published on July 12, 2024 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

platform/x86: x86-android-tablets: Unregister devices in reverse order

Not all subsystems support a device getting removed while there are

still consumers of the device with a reference to the device.

One example of this is the regulator subsystem. If a regulator gets

unregistered while there are still drivers holding a reference

a WARN() at drivers/regulator/core.c:5829 triggers, e.g.:

WARNING: CPU: 1 PID: 1587 at drivers/regulator/core.c:5829 regulator_unregister

Hardware name: Intel Corp. VALLEYVIEW C0 PLATFORM/BYT-T FFD8, BIOS BLADE_21.X64.0005.R00.1504101516 FFD8_X64_R_2015_04_10_1516 04/10/2015

RIP: 0010:regulator_unregister

Call Trace:

<TASK>

regulator_unregister

devres_release_group

i2c_device_remove

device_release_driver_internal

bus_remove_device

device_del

device_unregister

x86_android_tablet_remove

On the Lenovo Yoga Tablet 2 series the bq24190 charger chip also provides

a 5V boos

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

Vendor	Product	Versions	Status
linux	linux_kernel	>= 5.17, < 6.6.64	Affected

References

Ref git.kernel.org/stable/c/36ff963c133a25ed1166a25c3ba8b357ea010fda Ref git.kernel.org/stable/c/3de0f2627ef849735f155c1818247f58404dddfe Ref git.kernel.org/stable/c/f0c982853d665597d17e4995ff479fbbf79a9cf6 Ref git.kernel.org/stable/c/3de0f2627ef849735f155c1818247f58404dddfe Ref git.kernel.org/stable/c/f0c982853d665597d17e4995ff479fbbf79a9cf6

Frequently Asked Questions

What is CVE-2024-40975?

CVE-2024-40975 is a medium-severity vulnerability affecting linux linux_kernel. It was published on July 12, 2024 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2024-40975?

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2024-40975?

How can CyberStrike help with CVE-2024-40975?

CyberStrike's AI-powered security agents can automatically detect CVE-2024-40975 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.

How CyberStrike Helps

Autonomous Discovery

AI agents map your attack surface to find vulnerabilities like this one.

Continuous Pentesting

Automated penetration testing that runs continuously, not just quarterly.

Code Review

AI-driven PR review catches vulnerable dependencies before they ship.

HackBrowser

Browser-based exploitation validates findings with real proof-of-concept.

Related MEDIUM CVEs from 2024

View all →

6.9

CVE-2023-3726

OCSInventory allow stored email template with special characters that lead to a Stored cross-site Sc

6.9

CVE-2023-51719