Lucene search

416baaa9-dc9f-4396-8d5f-8c081fb06d67CVE-2024-35992

HistoryMay 20, 2024 - 10:15 a.m.

CVE-2024-35992

2024-05-2010:15:13

CWE-125

416baaa9-dc9f-4396-8d5f-8c081fb06d67

web.nvd.nist.gov

linux kernel

vulnerability

cve-2024-35992

out of bounds read

fix

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

6.6 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

5.1%

JSON

In the Linux kernel, the following vulnerability has been resolved:

phy: marvell: a3700-comphy: Fix out of bounds read

There is an out of bounds read access of ‘gbe_phy_init_fix[fix_idx].addr’
every iteration after ‘fix_idx’ reaches ‘ARRAY_SIZE(gbe_phy_init_fix)’.

Make sure ‘gbe_phy_init[addr]’ is used when all elements of
‘gbe_phy_init_fix’ array are handled.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Affected configurations

Vulners

NVD

Node

linuxlinux_kernelRange5.18–6.1.90

linuxlinux_kernelRange6.2.0–6.6.30

linuxlinux_kernelRange6.7.0–6.8.9

linuxlinux_kernelRange6.9.0≥

CPENameOperatorVersion
linux:linux_kernellinux linux kernellt6.1.90
linux:linux_kernellinux linux kernellt6.6.30
linux:linux_kernellinux linux kernellt6.8.9

CPE	Name	Operator	Version
linux:linux_kernel	linux linux kernel	lt	6.1.90
linux:linux_kernel	linux linux kernel	lt	6.6.30
linux:linux_kernel	linux linux kernel	lt	6.8.9

CNA Affected

[
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "unaffected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "drivers/phy/marvell/phy-mvebu-a3700-comphy.c"
    ],
    "versions": [
      {
        "version": "934337080c6c",
        "lessThan": "976df695f579",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "934337080c6c",
        "lessThan": "610f175d2e16",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "934337080c6c",
        "lessThan": "40406dfbc060",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "934337080c6c",
        "lessThan": "e4308bc22b9d",
        "status": "affected",
        "versionType": "git"
      }
    ]
  },
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "affected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "drivers/phy/marvell/phy-mvebu-a3700-comphy.c"
    ],
    "versions": [
      {
        "version": "5.18",
        "status": "affected"
      },
      {
        "version": "0",
        "lessThan": "5.18",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.1.90",
        "lessThanOrEqual": "6.1.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.6.30",
        "lessThanOrEqual": "6.6.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.8.9",
        "lessThanOrEqual": "6.8.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.9",
        "lessThanOrEqual": "*",
        "status": "unaffected",
        "versionType": "original_commit_for_fix"
      }
    ]
  }
]

References

git.kernel.org/stable/c/40406dfbc060503d2e0a9e637e98493c54997b3d

git.kernel.org/stable/c/610f175d2e16fb2436ba7974b990563002c20d07

git.kernel.org/stable/c/976df695f579bbb2914114b4e9974fe4ed1eb813

git.kernel.org/stable/c/e4308bc22b9d46cf33165c9dfaeebcf29cd56f04

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

6.6 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for CVE-2024-35992