01 Record

CVE-2024-46865

fou: fix initialization of grc

CriticalPUBLISHEDCNA: Linux

CNA base score9.8 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

fou: fix initialization of grc

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.54% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 45.5% of scored records. A rank, not a probability.

NVD base score

7.1 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-10-15.

Red Hat severity

Low. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2024-09-27 12:42Z2 YR AGO

Last updated

2026-10-15 00:50Z15 DAYS AGO

Reserved

2024-09-11

Assigning CNA

Linux

Record state

PUBLISHED

Severity

Critical (CVSS 9.8)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-908Use of Uninitialized ResourceBase
CWE-20Improper Input ValidationClass

Data version

5.2

Document digest

3acc3607d2da687ee5a0a6738849f0612bc9be93ef4046c9ae9b94228a3390e6

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux231c235d2f7a66f018f172e26ffd47c363f244ef to < 392f6a97fcbecc64f0c00058b2db5bb0e4b8cc3e, 4494bccb52ffda22ce5a1163a776d970e6229e08 to < 16ff0895283058b0f96d4fe277aa25ee096f0ea8, d7567f098f54cb53ee3cee1c82e3d0ed9698b6b3 to < 5d537b8d900514509622ce92330b70d2e581d409, 1df42be305fe478ded1ee0c1d775f4ece713483b to < 7ae890ee19479eeeb87724cca8430b5cb3660c74, c46cd6aaca81040deaea3500ba75126963294bd9 to < aca06c617c83295f0caa486ad608fbef7bdc11e8, 7e4196935069947d8b70b09c1660b67b067e75cb to < 4c8002277167125078e6b9b90137bdf443ebaa08, 5.10.226 to < 5.10.227, 5.15.167 to < 5.15.168, 6.1.110 to < 6.1.111, 6.6.51 to < 6.6.52, 6.10.10 to < 6.10.11—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/392f6a97fcbecc64f0c00058b2db5bb0e4b8cc3e
git.kernel.orghttps://git.kernel.org/stable/c/16ff0895283058b0f96d4fe277aa25ee096f0ea8
git.kernel.orghttps://git.kernel.org/stable/c/5d537b8d900514509622ce92330b70d2e581d409
git.kernel.orghttps://git.kernel.org/stable/c/7ae890ee19479eeeb87724cca8430b5cb3660c74
git.kernel.orghttps://git.kernel.org/stable/c/aca06c617c83295f0caa486ad608fbef7bdc11e8
git.kernel.orghttps://git.kernel.org/stable/c/4c8002277167125078e6b9b90137bdf443ebaa08
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2025/03/msg00002.html
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-265688.html

07 Fixed in

Debian 12

linux
Fixed in 6.1.112-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.10.11-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 6.10.11-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.