CVE-2024-36975

Source
https://nvd.nist.gov/vuln/detail/CVE-2024-36975
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-36975.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-36975
Downstream
Related
Published
2024-06-18T20:15:13Z
Modified
2025-08-09T19:01:28Z
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

KEYS: trusted: Do not use WARN when encode fails

When asn1encodesequence() fails, WARN is not the correct solution.

  1. asn1encodesequence() is not an internal function (located in lib/asn1_encode.c).
  2. Location is known, which makes the stack trace useless.
  3. Results a crash if paniconwarn is set.

It is also noteworthy that the use of WARN is undocumented, and it should be avoided unless there is a carefully considered rationale to use it.

Replace WARN with pr_err, and print the return value instead, which is only useful piece of information.

References

Affected packages