CVE-2024-36975

In the Linux kernel, the following vulnerability has been resolved:

KEYS: trusted: Do not use WARN when encode fails

When asn1_encode_sequence() fails, WARN is not the correct solution.

1. asn1_encode_sequence() is not an internal function (located in lib/asn1_encode.c).
2. Location is known, which makes the stack trace useless.
3. Results a crash if panic_on_warn is set.

It is also noteworthy that the use of WARN is undocumented, and it should be avoided unless there is a carefully considered rationale to use it.

Replace WARN with pr_err, and print the return value instead, which is only useful piece of information.

This vulnerability is rated as Moderate impact because an authenticated local user can trigger an unnecessary kernel warning condition within the trusted keys subsystem, which only escalates to a denial of service if the system is explicitly configured to panic on warnings. On default Red Hat Enterprise Linux installations, the panic-on-warn diagnostic behavior is disabled, meaning the triggering condition generates a kernel log entry rather than interrupting system availability. Because exploitation requires local access, does not bypass authentication, and cannot compromise data confidentiality or integrity, the overall risk to enterprise deployments remains limited.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.