CVE-2024-56745

5.5 · MEDIUM

Published Dec 29, 2024 linux CWE-401 EPSS 0.21% (11th pctl) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Overview

CVE-2024-56745 is a medium-severity vulnerability affecting linux linux_kernel. It was published on December 29, 2024 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

PCI: Fix reset_method_store() memory leak

In reset_method_store(), a string is allocated via kstrndup() and assigned

to the local "options". options is then used in with strsep() to find

spaces:

while ((name = strsep(&options, " ")) != NULL) {

If there are no remaining spaces, then options is set to NULL by strsep(),

so the subsequent kfree(options) doesn't free the memory allocated via

kstrndup().

Fix by using a separate tmp_options to iterate with strsep() so options is

preserved.

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

Vendor	Product	Versions	Status
linux	linux_kernel	>= 5.15, < 5.15.174	Affected

References

Ref git.kernel.org/stable/c/2985b1844f3f3447f2d938eff1ef6762592065a5 Ref git.kernel.org/stable/c/403efb4457c0c8f8f51e904cc57d39193780c6bd Ref git.kernel.org/stable/c/543d0eb40e45c6a51f1bff02f417b602e54472d5 Ref git.kernel.org/stable/c/8e098baf6bc3f3a6aefc383509aba07e202f7ee0 Ref git.kernel.org/stable/c/931d07ccffcc3614f20aaf602b31e89754e21c59 Ref git.kernel.org/stable/c/fe6fae61f3b993160aef5fe2b7141a83872c144f Ref lists.debian.org/debian-lts-announce/2025/03/msg00001.html

Frequently Asked Questions

What is CVE-2024-56745?

CVE-2024-56745 is a medium-severity vulnerability affecting linux linux_kernel. It was published on December 29, 2024 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2024-56745?

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2024-56745?

How can CyberStrike help with CVE-2024-56745?

CyberStrike's AI-powered security agents can automatically detect CVE-2024-56745 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.

How CyberStrike Helps

Autonomous Discovery

AI agents map your attack surface to find vulnerabilities like this one.

Continuous Pentesting

Automated penetration testing that runs continuously, not just quarterly.

Code Review

AI-driven PR review catches vulnerable dependencies before they ship.

HackBrowser

Browser-based exploitation validates findings with real proof-of-concept.

Related MEDIUM CVEs from 2024

View all →

6.9

CVE-2023-3726

OCSInventory allow stored email template with special characters that lead to a Stored cross-site Sc

6.9

CVE-2023-51719