CVE-2024-56769

5.5 · MEDIUM

Published Jan 6, 2025 linux CWE-908 EPSS 0.23% (14th pctl) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Overview

CVE-2024-56769 is a medium-severity vulnerability affecting linux linux_kernel. It was published on January 6, 2025 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg

Syzbot reports [1] an uninitialized value issue found by KMSAN in

dib3000_read_reg().

Local u8 rb[2] is used in i2c_transfer() as a read buffer; in case

that call fails, the buffer may end up with some undefined values.

Since no elaborate error handling is expected in dib3000_write_reg(),

simply zero out rb buffer to mitigate the problem.

[1] Syzkaller report

dvb-usb: bulk message failed: -22 (6/0)

=====================================================

BUG: KMSAN: uninit-value in dib3000mb_attach+0x2d8/0x3c0 drivers/media/dvb-frontends/dib3000mb.c:758

dib3000mb_attach+0x2d8/0x3c0 drivers/media/dvb-frontends/dib3000mb.c:758

dibusb_dib3000mb_frontend_attach+0x155/0x2f0 drivers/media/usb/dvb-usb/dibusb-mb.c:31

dvb_usb_adapter_frontend_init+0xed/0x9a0 drivers/media/usb/dvb-usb/dvb-usb-dvb.c:290

dvb_usb_adapter_init drivers/media/usb/dvb-usb/dvb-

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

Vendor	Product	Versions	Status
linux	linux_kernel	>= 2.6.19, < 6.1.123	Affected

References

Ref git.kernel.org/stable/c/035772fcd631eee2756b31cb6df249c0a8d453d7 Ref git.kernel.org/stable/c/1d6de21f00293d819b5ca6dbe75ff1f3b6392140 Ref git.kernel.org/stable/c/2dd59fe0e19e1ab955259978082b62e5751924c7 Ref git.kernel.org/stable/c/3876e3a1c31a58a352c6bf5d2a90e3304445a637 Ref git.kernel.org/stable/c/53106510736e734ce8b731ba871363389bfbf4c9 Ref git.kernel.org/stable/c/c1197c1457bb7098cf46366e898eb52b41b6876a Ref git.kernel.org/stable/c/e11778189513cd7fb2edced5bd053bc18ede8418 Ref lists.debian.org/debian-lts-announce/2025/03/msg00001.html Ref lists.debian.org/debian-lts-announce/2025/03/msg00002.html

Frequently Asked Questions

What is CVE-2024-56769?

CVE-2024-56769 is a medium-severity vulnerability affecting linux linux_kernel. It was published on January 6, 2025 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2024-56769?

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2024-56769?

How can CyberStrike help with CVE-2024-56769?

CyberStrike's AI-powered security agents can automatically detect CVE-2024-56769 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.

How CyberStrike Helps

Autonomous Discovery

AI agents map your attack surface to find vulnerabilities like this one.

Continuous Pentesting

Automated penetration testing that runs continuously, not just quarterly.

Code Review

AI-driven PR review catches vulnerable dependencies before they ship.

HackBrowser

Browser-based exploitation validates findings with real proof-of-concept.

Related MEDIUM CVEs from 2024

View all →

6.9

CVE-2023-3726

OCSInventory allow stored email template with special characters that lead to a Stored cross-site Sc

6.9

CVE-2023-51719