{"api_version":"1","generated_at":"2026-07-23T13:26:06+00:00","cve":"CVE-2024-46859","urls":{"html":"https://cve.report/CVE-2024-46859","api":"https://cve.report/api/cve/CVE-2024-46859.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2024-46859","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2024-46859"},"summary":{"title":"platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: panasonic-laptop: Fix SINF array out of bounds accesses\n\nThe panasonic laptop code in various places uses the SINF array with index\nvalues of 0 - SINF_CUR_BRIGHT(0x0d) without checking that the SINF array\nis big enough.\n\nNot all panasonic laptops have this many SINF array entries, for example\nthe Toughbook CF-18 model only has 10 SINF array entries. So it only\nsupports the AC+DC brightness entries and mute.\n\nCheck that the SINF array has a minimum size which covers all AC+DC\nbrightness entries and refuse to load if the SINF array is smaller.\n\nFor higher SINF indexes hide the sysfs attributes when the SINF array\ndoes not contain an entry for that attribute, avoiding show()/store()\naccessing the array out of bounds and add bounds checking to the probe()\nand resume() code accessing these.","state":"PUBLISHED","assigner":"Linux","published_at":"2024-09-27 13:15:17","updated_at":"2026-05-05 15:06:23"},"problem_types":["CWE-129"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}}],"references":[{"url":"https://git.kernel.org/stable/c/6821a82616f60aa72c5909b3e252ad97fb9f7e2a","name":"https://git.kernel.org/stable/c/6821a82616f60aa72c5909b3e252ad97fb9f7e2a","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b38c19783286a71693c2194ed1b36665168c09c4","name":"https://git.kernel.org/stable/c/b38c19783286a71693c2194ed1b36665168c09c4","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/f52e98d16e9bd7dd2b3aef8e38db5cbc9899d6a4","name":"https://git.kernel.org/stable/c/f52e98d16e9bd7dd2b3aef8e38db5cbc9899d6a4","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/9291fadbd2720a869b1d2fcf82305648e2e62a16","name":"https://git.kernel.org/stable/c/9291fadbd2720a869b1d2fcf82305648e2e62a16","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html","name":"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b7c2f692307fe704be87ea80d7328782b33c3cef","name":"https://git.kernel.org/stable/c/b7c2f692307fe704be87ea80d7328782b33c3cef","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-46859","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46859","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected e424fb8cc4e6634c10f8159b1ff5618cf7bab9c6 b7c2f692307fe704be87ea80d7328782b33c3cef git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected e424fb8cc4e6634c10f8159b1ff5618cf7bab9c6 9291fadbd2720a869b1d2fcf82305648e2e62a16 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected e424fb8cc4e6634c10f8159b1ff5618cf7bab9c6 6821a82616f60aa72c5909b3e252ad97fb9f7e2a git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected e424fb8cc4e6634c10f8159b1ff5618cf7bab9c6 b38c19783286a71693c2194ed1b36665168c09c4 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected e424fb8cc4e6634c10f8159b1ff5618cf7bab9c6 f52e98d16e9bd7dd2b3aef8e38db5cbc9899d6a4 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3.3","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 3.3 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.168 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.111 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.52 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.10.11 6.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.11 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2024","cve_id":"46859","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"11.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2024","cve_id":"46859","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2024-46859","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-09-29T13:57:08.389850Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2024-09-29T13:57:13.392Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"},{"providerMetadata":{"dateUpdated":"2025-11-03T22:19:46.186Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}],"title":"CVE Program Container"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/platform/x86/panasonic-laptop.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b7c2f692307fe704be87ea80d7328782b33c3cef","status":"affected","version":"e424fb8cc4e6634c10f8159b1ff5618cf7bab9c6","versionType":"git"},{"lessThan":"9291fadbd2720a869b1d2fcf82305648e2e62a16","status":"affected","version":"e424fb8cc4e6634c10f8159b1ff5618cf7bab9c6","versionType":"git"},{"lessThan":"6821a82616f60aa72c5909b3e252ad97fb9f7e2a","status":"affected","version":"e424fb8cc4e6634c10f8159b1ff5618cf7bab9c6","versionType":"git"},{"lessThan":"b38c19783286a71693c2194ed1b36665168c09c4","status":"affected","version":"e424fb8cc4e6634c10f8159b1ff5618cf7bab9c6","versionType":"git"},{"lessThan":"f52e98d16e9bd7dd2b3aef8e38db5cbc9899d6a4","status":"affected","version":"e424fb8cc4e6634c10f8159b1ff5618cf7bab9c6","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/platform/x86/panasonic-laptop.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.3"},{"lessThan":"3.3","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.168","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.111","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.52","versionType":"semver"},{"lessThanOrEqual":"6.10.*","status":"unaffected","version":"6.10.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.11","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.168","versionStartIncluding":"3.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.111","versionStartIncluding":"3.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.52","versionStartIncluding":"3.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.10.11","versionStartIncluding":"3.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.11","versionStartIncluding":"3.3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: panasonic-laptop: Fix SINF array out of bounds accesses\n\nThe panasonic laptop code in various places uses the SINF array with index\nvalues of 0 - SINF_CUR_BRIGHT(0x0d) without checking that the SINF array\nis big enough.\n\nNot all panasonic laptops have this many SINF array entries, for example\nthe Toughbook CF-18 model only has 10 SINF array entries. So it only\nsupports the AC+DC brightness entries and mute.\n\nCheck that the SINF array has a minimum size which covers all AC+DC\nbrightness entries and refuse to load if the SINF array is smaller.\n\nFor higher SINF indexes hide the sysfs attributes when the SINF array\ndoes not contain an entry for that attribute, avoiding show()/store()\naccessing the array out of bounds and add bounds checking to the probe()\nand resume() code accessing these."}],"providerMetadata":{"dateUpdated":"2025-05-04T09:36:07.377Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/b7c2f692307fe704be87ea80d7328782b33c3cef"},{"url":"https://git.kernel.org/stable/c/9291fadbd2720a869b1d2fcf82305648e2e62a16"},{"url":"https://git.kernel.org/stable/c/6821a82616f60aa72c5909b3e252ad97fb9f7e2a"},{"url":"https://git.kernel.org/stable/c/b38c19783286a71693c2194ed1b36665168c09c4"},{"url":"https://git.kernel.org/stable/c/f52e98d16e9bd7dd2b3aef8e38db5cbc9899d6a4"}],"title":"platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2024-46859","datePublished":"2024-09-27T12:42:49.801Z","dateReserved":"2024-09-11T15:12:18.291Z","dateUpdated":"2025-11-03T22:19:46.186Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2024-09-27 13:15:17","lastModifiedDate":"2026-05-05 15:06:23","problem_types":["CWE-129"],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*","matchCriteriaId":"FA6FEEC2-9F11-4643-8827-749718254FED"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.3","versionEndExcluding":"5.15.168","matchCriteriaId":"EEA95E12-79A8-47FD-AB10-B23C7A3F1151"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.1.111","matchCriteriaId":"FCBCD375-91FC-4790-94C0-6FF9C68F6498"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.6.52","matchCriteriaId":"02ADDA94-95BB-484D-8E95-63C0428A28E3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.10.11","matchCriteriaId":"F5DB5367-F1F5-4200-B3B3-FDF8AFC3D255"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*","matchCriteriaId":"8B3CE743-2126-47A3-8B7C-822B502CF119"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*","matchCriteriaId":"4DEB27E7-30AA-45CC-8934-B89263EF3551"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*","matchCriteriaId":"E0005AEF-856E-47EB-BFE4-90C46899394D"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*","matchCriteriaId":"39889A68-6D34-47A6-82FC-CD0BF23D6754"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*","matchCriteriaId":"B8383ABF-1457-401F-9B61-EE50F4C61F4F"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:*","matchCriteriaId":"B77A9280-37E6-49AD-B559-5B23A3B1DC3D"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.11:rc7:*:*:*:*:*:*","matchCriteriaId":"DE5298B3-04B4-4F3E-B186-01A58B5C75A6"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2024","CveId":"46859","Ordinal":"1","Title":"platform/x86: panasonic-laptop: Fix SINF array out of bounds acc","CVE":"CVE-2024-46859","Year":"2024"},"notes":[{"CveYear":"2024","CveId":"46859","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: panasonic-laptop: Fix SINF array out of bounds accesses\n\nThe panasonic laptop code in various places uses the SINF array with index\nvalues of 0 - SINF_CUR_BRIGHT(0x0d) without checking that the SINF array\nis big enough.\n\nNot all panasonic laptops have this many SINF array entries, for example\nthe Toughbook CF-18 model only has 10 SINF array entries. So it only\nsupports the AC+DC brightness entries and mute.\n\nCheck that the SINF array has a minimum size which covers all AC+DC\nbrightness entries and refuse to load if the SINF array is smaller.\n\nFor higher SINF indexes hide the sysfs attributes when the SINF array\ndoes not contain an entry for that attribute, avoiding show()/store()\naccessing the array out of bounds and add bounds checking to the probe()\nand resume() code accessing these.","Type":"Description","Title":"platform/x86: panasonic-laptop: Fix SINF array out of bounds acc"}]}}}