Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2024-41029: Linux kernel restricts cell file permissions to match main setting
CVE-2024-41029 · published 2 years ago
Summary
The Linux kernel could expose certain internal data through a special file interface, allowing anyone to read it even when the main setting was limited to administrators only. This could let unauthorized users view sensitive information. Apply the latest kernel updates to ensure the permissions are correctly enforced.
What to do
- Update debian linux to version 6.9.10-1.
- Update linux kernel to version 6.9.10.
- Update linux linux_kernel to version 6.9.10 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:13 | debian | linux |
< 6.9.10-1 Fix: upgrade to 6.9.10-1
|
| Debian:14 | debian | linux |
< 6.9.10-1 Fix: upgrade to 6.9.10-1
|
| – | linux | linux_kernel |
>= 6.8, < 6.9.10 6.10 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Linux | linux | kernel |
>= 6.8.0, < 6.9.10 Fix: upgrade to 6.9.10
|
Original advisory text
nvmem: core: limit cell sysfs permissions to main attribute ones
In the Linux kernel, the following vulnerability has been resolved: nvmem: core: limit cell sysfs permissions to main attribute ones The cell sysfs attribute should not provide more access to the nvmem data than the main attribute itself. For example if nvme_config::root_only was set, the cell attribute would still provide read access to everybody. Mask out permissions not available on the main attribute.
References
- https://security-tracker.debian.org/tracker/CVE-2024-41029 Vendor Advisory
- https://git.kernel.org/stable/c/6bef98bafd82903a8d461463f9594f19f1fd6a85 URL
- https://git.kernel.org/stable/c/aa066afaaac32caf2160d58d4e3010ee04421c62 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41029... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-41029 Vendor Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Product
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Timeline
Published29 Jul 2024
Updated4 Nov 2026
First seen1 Sep 2026
Track software like this
Free during beta