CVE-2024-40994

A vulnerability was found in the Linux kernel's ptp subsystem in ptp_sysfs.c file, where the max_vclocks_store function can cause an integer overflow on 32-bit systems. This issue occurs during a multiplication operation, potentially leading to incorrect memory allocation, resulting in memory corruption.

The function where incorrect initialization of memory could happen is not being used. The idea is to make param max_vclocks configurable via /sys/class/ptp/ptpN/max_vclocks. However, /sys/class/ptp/ptp0/max_vclocks does not exist yet and this function is not being called.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.