CVE-2024-46745

A flaw was found in the Linux kernel's uinput interface. A local user could exploit this vulnerability by attempting to set up a uinput device with an unreasonably large number of slots. This action triggers a memory allocation failure, which can place a significant burden on the system, potentially leading to a Denial of Service (DoS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To prevent a local attacker from exploiting this vulnerability, the uinput kernel module can be blacklisted. This will prevent the creation of virtual input devices.

echo "install uinput /bin/true" | sudo tee /etc/modprobe.d/disable-uinput.conf

After applying this change, a system reboot is required for the blacklist to take full effect if the module is already loaded. Disabling uinput may impact applications that rely on virtual input devices.