CVE-2024-45008

What it actually does

The flaw permits userspace to supply an arbitrarily large num_slots value via ioctl(UI_DEV_CREATE) to input_mt_init_slots(), resulting in excessive kernel memory allocation without an upper bound check.

Why it matters to the business

Attackers with local access can trigger kernel memory exhaustion, leading to system instability, denial of service, or crashes on affected Linux systems; the large number of downstream dependents increases operational risk across distributions and embedded devices.

How an attack unfolds

An attacker with local access creates a virtual input device using UI_DEV_CREATE ioctl, supplies a very large slot count, and forces the kernel to attempt an oversized allocation that can exhaust memory resources; listed threat actors in 2024 zero-day campaigns and Linux kernel resource issues indicate potential interest from espionage and financially motivated groups.

How to fix it

Update the Linux kernel to commit 2829c80614890624456337e47320289112785f3e or later releases that enforce the 1024 slot limit; apply the corresponding stable or distribution kernel package that includes this fix.

How to confirm the fix worked

Verify the running kernel contains commit 2829c80614890624456337e47320289112785f3e or a patched version; test by attempting UI_DEV_CREATE with num_slots > 1024 and confirm the allocation is now rejected or capped.

Typical attack path

1. Obtain local user access on a vulnerable Linux system
2. Open /dev/uinput or equivalent and issue UI_DEV_CREATE ioctl with crafted num_slots value exceeding 1024
3. Trigger input_mt_init_slots() allocation that consumes excessive kernel memory
4. Repeat or combine with other operations to exhaust available memory and cause denial of service or crash

How to detect it

Review kernel logs for allocation failures or warnings around input_mt_init_slots and UI_DEV_CREATE; inspect audit logs or system call traces for repeated or oversized ioctl calls to uinput from untrusted processes; correlate with memory pressure events.

What your security team should do

• Prioritize kernel updates to the fixed commit on all production systems within the next patch cycle
• Monitor EPSS trend and any new threat actor activity for increased exploitation likelihood
• Restrict unprivileged access to uinput and input device creation where feasible using AppArmor or SELinux policies
• Include kernel version checks in vulnerability scanning and asset inventory processes