medium 5.5

CVE-2024-46745 json

Input: uinput - reject requests with unreasonable number of slots

published 2024-09-18 2 y ago modified 2026-10-15 25 d ago also EUVD-2024-42006

cvss: 5.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 20%
public exploits: 0; none known

In the Linux kernel, the following vulnerability has been resolved:

When exercising uinput interface syzkaller may try setting up device with a really large number of slots, which causes memory allocation failure in input_mt_init_slots(). While this allocation failure is handled properly and request is rejected, it results in syzkaller reports. Additionally, such request may put undue burden on the system which will try to free a lot of memory for a bogus request.

Fix it by limiting allowed number of slots to 100. This can easily be extended if we see devices that can track more than 100 contacts.

Patch / fix

fixed in 8 distros 4 links 8

Linux Linux 4.19.322, 5.4.284, 5.10.226, 5.15.167, 6.1.110, 6.6.51, 6.10.10, 6.11
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem V1.1.1
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
Siemens RUGGEDCOM RST2428P V3.2
Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family V3.2
Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 family V3.2

debian ubuntu red hat suse

linux Debian 12 6.1.112-1
linux Debian 14, Debian 13 6.10.11-1

debian advisories DEBIAN-CVE-2024-46745

linux Ubuntu 20.04 LTS 5.4.0-200.220
linux Ubuntu 22.04 LTS 5.15.0-125.135
linux Ubuntu 24.04 LTS 6.8.0-50.51
linux-aws Ubuntu 20.04 LTS 5.4.0-1135.145
linux-aws Ubuntu 22.04 LTS 5.15.0-1072.78
linux-aws Ubuntu 24.04 LTS 6.8.0-1020.22
linux-gcp Ubuntu 20.04 LTS 5.4.0-1139.148
linux-gcp Ubuntu 22.04 LTS 5.15.0-1071.79

ubuntu advisories UBUNTU-CVE-2024-46745

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel RHEL 9 5.14.0-570.12.1.el9_6
rv RHEL 9 5.14.0-570.12.1.el9_6
perf RHEL 9 5.14.0-570.12.1.el9_6
rtla RHEL 9 5.14.0-570.12.1.el9_6
libperf RHEL 9 5.14.0-570.12.1.el9_6
kernel-rt RHEL 9 5.14.0-570.12.1.el9_6
kernel-64k RHEL 9 5.14.0-570.12.1.el9_6
kernel-core RHEL 9 5.14.0-570.12.1.el9_6

red hat advisories RHSA-2025:6966

kernel-rt Linux Micro 6.0 6.4.0-11.1
kernel-source-rt Linux Micro 6.0 6.4.0-11.1
kernel-livepatch-MICRO-6-0-RT_Update_3 Linux Micro 6.0 1-1.2
kernel-source Linux Micro 6.0 6.4.0-20.1
kernel-default Linux Micro 6.0 6.4.0-20.1
kernel-kvmsmall Linux Micro 6.0 6.4.0-20.1
kernel-default-base Linux Micro 6.0 6.4.0-17.1.1.51
kernel-livepatch-MICRO-6-0_Update_3 Linux Micro 6.0 1-1.2

suse advisories SUSE-SU-2025:20077-1 SUSE-SU-2025:20073-1 SUSE-SU-2024:3592-1 SUSE-SU-2024:3591-1 SUSE-SU-2024:3587-1 SUSE-SU-2024:3569-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-46745 updated 2026-11-05 cvss 5.5

kernel: Input: uinput - reject requests with unreasonable number of slots

Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more
affected: workaround, no fix planned “Out of support scope”
Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more
affected: workaround, no fix planned “Will not fix”
Red Hat Enterprise Linux AppStream (v. 9) rv 5.14.0-570.12.1.el9_6, perf 5.14.0-570.12.1.el9_6, rtla 5.14.0-570.12.1.el9_6, python3-perf 5.14.0-570.12.1.el9_6, kernel-devel-matched 5.14.0-570.12.1.el9_6, kernel-64k-devel-matched 5.14.0-570.12.1.el9_6, +7 more Red Hat Enterprise Linux BaseOS (v. 9) kernel 5.14.0-570.12.1.el9_6, kernel-64k 5.14.0-570.12.1.el9_6, kernel-core 5.14.0-570.12.1.el9_6, kernel-tools 5.14.0-570.12.1.el9_6, kernel-modules 5.14.0-570.12.1.el9_6, kernel-64k-core 5.14.0-570.12.1.el9_6, +27 more Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libperf 5.14.0-570.12.1.el9_6, kernel-debuginfo-common-s390x 5.14.0-570.12.1.el9_6, kernel-debuginfo-common-x86_64 5.14.0-570.12.1.el9_6, kernel-debuginfo-common-aarch64 5.14.0-570.12.1.el9_6, kernel-debuginfo-common-ppc64le 5.14.0-570.12.1.el9_6 Red Hat Enterprise Linux Real Time (v. 9) kernel-rt 5.14.0-570.12.1.el9_6, kernel-rt-64k 5.14.0-570.12.1.el9_6, kernel-rt-core 5.14.0-570.12.1.el9_6, kernel-rt-modules 5.14.0-570.12.1.el9_6, kernel-rt-64k-core 5.14.0-570.12.1.el9_6, kernel-rt-debug-core 5.14.0-570.12.1.el9_6, +14 more Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt 5.14.0-570.12.1.el9_6, kernel-rt-kvm 5.14.0-570.12.1.el9_6, kernel-rt-core 5.14.0-570.12.1.el9_6, kernel-rt-modules 5.14.0-570.12.1.el9_6, kernel-rt-debug-kvm 5.14.0-570.12.1.el9_6, kernel-rt-debug-core 5.14.0-570.12.1.el9_6, +6 more
fixed: vendor fix RHSA-2025:6966

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-24-102-01 updated 2026-05-14 cvss 6.5

Siemens SIMATIC S7-1500 TM MFP

Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
affected: mitigation, no fix available

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-25-226-07 updated 2026-02-25 cvss 6.5

Siemens Third-Party Components in SINEC OS

Siemens RUGGEDCOM RST2428P (6GK6242-6PA00) < 3.2
affected: fixed in V3.2 support.industry.siemens.com
Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family < 3.2
affected: fixed in V3.2
Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 family < 3.2
affected: fixed in V3.2 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-23-348-10 updated 2025-08-12 cvss 6.5

Siemens SIMATIC S7-1500

Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.0, < 3.1.5
affected: fixed in V3.1.5, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-09-29)

Exploit prediction

0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Linux Linux
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP
Siemens RUGGEDCOM RST2428P
Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family
Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 family

Classification

Weakness

CWE-770 Allocation of Resources Without Limits or Throttling

Technology feeds

Linux kernel rss critical rss

References

Sources

CVE List CVE-2024-46745
NVD CVE-2024-46745

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary

Patch / fix

Vendor advisories

CISA SSVC

Exploit prediction

CVSS scores

Affected products

Classification

References

Sources