CVE-2024-35994

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-35994", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-17T13:50:33.147Z", "datePublished": "2024-05-20T09:47:58.396Z", "dateUpdated": "2026-08-05T11:31:28.204Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:31:28.204Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: qcom: uefisecapp: Fix memory related IO errors and crashes\n\nIt turns out that while the QSEECOM APP_SEND command has specific fields\nfor request and response buffers, uefisecapp expects them both to be in\na single memory region. Failure to adhere to this has (so far) resulted\nin either no response being written to the response buffer (causing an\nEIO to be emitted down the line), the SCM call to fail with EINVAL\n(i.e., directly from TZ/firmware), or the device to be hard-reset.\n\nWhile this issue can be triggered deterministically, in the current form\nit seems to happen rather sporadically (which is why it has gone\nunnoticed during earlier testing). This is likely due to the two\nkzalloc() calls (for request and response) being directly after each\nother. Which means that those likely return consecutive regions most of\nthe time, especially when not much else is going on in the system.\n\nFix this by allocating a single memory region for both request and\nresponse buffers, properly aligning both structs inside it. This\nunfortunately also means that the qcom_scm_qseecom_app_send() interface\nneeds to be restructured, as it should no longer map the DMA regions\nseparately. Therefore, move the responsibility of DMA allocation (or\nmapping) to the caller."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is reached through the local efivarfs filesystem (`read()` on /sys/firmware/efi/efivars/*), which drives the qcuefi efivar operations; there is no network or remote path to uefisecapp.\nAC:L - The commit states the issue \"can be triggered deterministically\" \u2014 it merely looks sporadic because idle-system slab behaviour happens to place the two kzalloc()s adjacently, and an attacker fully controls slab layout via concurrent allocation pressure, parallel readers, and choice of which variable (hence which kmalloc bucket) to read.\nPR:L - efivarfs contains no capable()/CAP_* checks whatsoever and creates variable files mode 0644 under a 0755 directory, so any local unprivileged user can read an EFI variable and drive the buggy request/response allocation pair twice per read().\nUI:N - The attacker triggers the path entirely from their own process by reading efivarfs files; no action by any other user or administrator is needed.\nS:U - The corruption and the reset both land on the same device under the kernel's own security authority; although the secure world is involved, this is scored as standard kernel-local impact rather than a VM/IOMMU boundary escape.\nC:H - When the buffers are non-contiguous the secure world reads and writes normal-world memory outside the regions the kernel allocated and mapped for it, giving out-of-bounds access to adjacent kernel slab objects that can be groomed and leveraged for kernel memory disclosure.\nI:H - The documented failure mode where \"no response [is] written to the response buffer\" means uefisecapp wrote the response into kernel memory outside the allocated response buffer \u2014 an out-of-bounds write by a higher-privileged agent into an attacker-groomable slab neighbour, which is exploitable for kernel memory corruption.\nA:H - The commit explicitly documents that the mismatch can cause \"the device to be hard-reset\", a full SoC reset, and the SCM/EIO failures also render the EFI variable interface unusable."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/firmware/qcom/qcom_qseecom_uefisecapp.c", "drivers/firmware/qcom/qcom_scm.c", "include/linux/firmware/qcom/qcom_qseecom.h", "include/linux/firmware/qcom/qcom_scm.h"], "versions": [{"version": "759e7a2b62eb3ef3c93ffeb5cca788a09627d7d9", "lessThan": "dd22b34fb53cb04b13b2f5eee5c9200bb091fc88", "status": "affected", "versionType": "git"}, {"version": "759e7a2b62eb3ef3c93ffeb5cca788a09627d7d9", "lessThan": "ed09f81eeaa8f9265e1787282cb283f10285c259", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/firmware/qcom/qcom_qseecom_uefisecapp.c", "drivers/firmware/qcom/qcom_scm.c", "include/linux/firmware/qcom/qcom_qseecom.h", "include/linux/firmware/qcom/qcom_scm.h"], "versions": [{"version": "6.7", "status": "affected"}, {"version": "0", "lessThan": "6.7", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.9", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.8.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.9"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/dd22b34fb53cb04b13b2f5eee5c9200bb091fc88"}, {"url": "https://git.kernel.org/stable/c/ed09f81eeaa8f9265e1787282cb283f10285c259"}], "title": "firmware: qcom: uefisecapp: Fix memory related IO errors and crashes", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-35994", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-20T14:05:44.255812Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:33:52.169Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:30:11.569Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/dd22b34fb53cb04b13b2f5eee5c9200bb091fc88", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ed09f81eeaa8f9265e1787282cb283f10285c259", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/dd22b34fb53cb04b13b2f5eee5c9200bb091fc88", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ed09f81eeaa8f9265e1787282cb283f10285c259", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:30:11.569Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-35994", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-20T14:05:44.255812Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:24.744Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "firmware: qcom: uefisecapp: Fix memory related IO errors and crashes", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is reached through the local efivarfs filesystem (`read()` on /sys/firmware/efi/efivars/*), which drives the qcuefi efivar operations; there is no network or remote path to uefisecapp.\nAC:L - The commit states the issue \"can be triggered deterministically\" \u2014 it merely looks sporadic because idle-system slab behaviour happens to place the two kzalloc()s adjacently, and an attacker fully controls slab layout via concurrent allocation pressure, parallel readers, and choice of which variable (hence which kmalloc bucket) to read.\nPR:L - efivarfs contains no capable()/CAP_* checks whatsoever and creates variable files mode 0644 under a 0755 directory, so any local unprivileged user can read an EFI variable and drive the buggy request/response allocation pair twice per read().\nUI:N - The attacker triggers the path entirely from their own process by reading efivarfs files; no action by any other user or administrator is needed.\nS:U - The corruption and the reset both land on the same device under the kernel's own security authority; although the secure world is involved, this is scored as standard kernel-local impact rather than a VM/IOMMU boundary escape.\nC:H - When the buffers are non-contiguous the secure world reads and writes normal-world memory outside the regions the kernel allocated and mapped for it, giving out-of-bounds access to adjacent kernel slab objects that can be groomed and leveraged for kernel memory disclosure.\nI:H - The documented failure mode where \"no response [is] written to the response buffer\" means uefisecapp wrote the response into kernel memory outside the allocated response buffer \u2014 an out-of-bounds write by a higher-privileged agent into an attacker-groomable slab neighbour, which is exploitable for kernel memory corruption.\nA:H - The commit explicitly documents that the mismatch can cause \"the device to be hard-reset\", a full SoC reset, and the SCM/EIO failures also render the EFI variable interface unusable."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "759e7a2b62eb3ef3c93ffeb5cca788a09627d7d9", "lessThan": "dd22b34fb53cb04b13b2f5eee5c9200bb091fc88", "versionType": "git"}, {"status": "affected", "version": "759e7a2b62eb3ef3c93ffeb5cca788a09627d7d9", "lessThan": "ed09f81eeaa8f9265e1787282cb283f10285c259", "versionType": "git"}], "programFiles": ["drivers/firmware/qcom/qcom_qseecom_uefisecapp.c", "drivers/firmware/qcom/qcom_scm.c", "include/linux/firmware/qcom/qcom_qseecom.h", "include/linux/firmware/qcom/qcom_scm.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.7"}, {"status": "unaffected", "version": "0", "lessThan": "6.7", "versionType": "semver"}, {"status": "unaffected", "version": "6.8.9", "versionType": "semver", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/firmware/qcom/qcom_qseecom_uefisecapp.c", "drivers/firmware/qcom/qcom_scm.c", "include/linux/firmware/qcom/qcom_qseecom.h", "include/linux/firmware/qcom/qcom_scm.h"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/dd22b34fb53cb04b13b2f5eee5c9200bb091fc88"}, {"url": "https://git.kernel.org/stable/c/ed09f81eeaa8f9265e1787282cb283f10285c259"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: qcom: uefisecapp: Fix memory related IO errors and crashes\n\nIt turns out that while the QSEECOM APP_SEND command has specific fields\nfor request and response buffers, uefisecapp expects them both to be in\na single memory region. Failure to adhere to this has (so far) resulted\nin either no response being written to the response buffer (causing an\nEIO to be emitted down the line), the SCM call to fail with EINVAL\n(i.e., directly from TZ/firmware), or the device to be hard-reset.\n\nWhile this issue can be triggered deterministically, in the current form\nit seems to happen rather sporadically (which is why it has gone\nunnoticed during earlier testing). This is likely due to the two\nkzalloc() calls (for request and response) being directly after each\nother. Which means that those likely return consecutive regions most of\nthe time, especially when not much else is going on in the system.\n\nFix this by allocating a single memory region for both request and\nresponse buffers, properly aligning both structs inside it. This\nunfortunately also means that the qcom_scm_qseecom_app_send() interface\nneeds to be restructured, as it should no longer map the DMA regions\nseparately. Therefore, move the responsibility of DMA allocation (or\nmapping) to the caller."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8.9", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9", "versionStartIncluding": "6.7"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:31:28.204Z"}}}, "cveMetadata": {"cveId": "CVE-2024-35994", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:31:28.204Z", "dateReserved": "2024-05-17T13:50:33.147Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-20T09:47:58.396Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/firmware/qcom/qcom_qseecom_uefisecapp.c", "drivers/firmware/qcom/qcom_scm.c", "include/linux/firmware/qcom/qcom_qseecom.h", "include/linux/firmware/qcom/qcom_scm.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "dd22b34fb53cb04b13b2f5eee5c9200bb091fc88", "status": "affected", "version": "759e7a2b62eb3ef3c93ffeb5cca788a09627d7d9", "versionType": "git"}, {"lessThan": "ed09f81eeaa8f9265e1787282cb283f10285c259", "status": "affected", "version": "759e7a2b62eb3ef3c93ffeb5cca788a09627d7d9", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/firmware/qcom/qcom_qseecom_uefisecapp.c", "drivers/firmware/qcom/qcom_scm.c", "include/linux/firmware/qcom/qcom_qseecom.h", "include/linux/firmware/qcom/qcom_scm.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.7"}, {"lessThan": "6.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5F9041E5-8358-4EF7-8F98-B812EDE49612", "versionEndExcluding": "6.8.9", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*", "matchCriteriaId": "22BEDD49-2C6D-402D-9DBF-6646F6ECD10B", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*", "matchCriteriaId": "DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*", "matchCriteriaId": "52048DDA-FC5A-4363-95A0-A6357B4D7F8C", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*", "matchCriteriaId": "A06B2CCF-3F43-4FA9-8773-C83C3F5764B2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*", "matchCriteriaId": "F850DCEC-E08B-4317-A33B-D2DCF39F601B", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: qcom: uefisecapp: Fix memory related IO errors and crashes\n\nIt turns out that while the QSEECOM APP_SEND command has specific fields\nfor request and response buffers, uefisecapp expects them both to be in\na single memory region. Failure to adhere to this has (so far) resulted\nin either no response being written to the response buffer (causing an\nEIO to be emitted down the line), the SCM call to fail with EINVAL\n(i.e., directly from TZ/firmware), or the device to be hard-reset.\n\nWhile this issue can be triggered deterministically, in the current form\nit seems to happen rather sporadically (which is why it has gone\nunnoticed during earlier testing). This is likely due to the two\nkzalloc() calls (for request and response) being directly after each\nother. Which means that those likely return consecutive regions most of\nthe time, especially when not much else is going on in the system.\n\nFix this by allocating a single memory region for both request and\nresponse buffers, properly aligning both structs inside it. This\nunfortunately also means that the qcom_scm_qseecom_app_send() interface\nneeds to be restructured, as it should no longer map the DMA regions\nseparately. Therefore, move the responsibility of DMA allocation (or\nmapping) to the caller."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: firmware: qcom: uefisecapp: corrige errores y bloqueos de E/S relacionados con la memoria. Resulta que, si bien el comando QSEECOM APP_SEND tiene campos espec\u00edficos para los buffers de solicitud y respuesta, uefisecapp espera que ambos est\u00e9n en una \u00fanica regi\u00f3n de memoria. El incumplimiento de esto ha dado como resultado (hasta ahora) que no se escriba ninguna respuesta en el b\u00fafer de respuesta (lo que provoca que se emita un EIO en el futuro), que la llamada SCM falle con EINVAL (es decir, directamente desde TZ/firmware), o el dispositivo para ser reiniciado. Si bien este problema puede desencadenarse de manera determinista, en la forma actual parece ocurrir de manera bastante espor\u00e1dica (raz\u00f3n por la cual pas\u00f3 desapercibido durante las pruebas anteriores). Es probable que esto se deba a que las dos llamadas a kzalloc() (para solicitud y respuesta) est\u00e1n directamente una detr\u00e1s de la otra. Lo que significa que es probable que regresen a regiones consecutivas la mayor parte del tiempo, especialmente cuando no sucede mucho m\u00e1s en el sistema. Solucione este problema asignando una \u00fanica regi\u00f3n de memoria para los b\u00faferes de solicitud y respuesta, alineando adecuadamente ambas estructuras dentro de ella. Lamentablemente, esto tambi\u00e9n significa que la interfaz qcom_scm_qseecom_app_send() debe reestructurarse, ya que ya no deber\u00eda asignar las regiones DMA por separado. Por lo tanto, traslade la responsabilidad de la asignaci\u00f3n (o mapeo) de DMA a la persona que llama."}], "id": "CVE-2024-35994", "lastModified": "2026-08-04T11:18:20.113", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-35994", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-05-20T14:05:44.255812Z", "version": "2.0.3"}}]}, "published": "2024-05-20T10:15:13.530", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/dd22b34fb53cb04b13b2f5eee5c9200bb091fc88"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ed09f81eeaa8f9265e1787282cb283f10285c259"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/dd22b34fb53cb04b13b2f5eee5c9200bb091fc88"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ed09f81eeaa8f9265e1787282cb283f10285c259"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-401"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: firmware: qcom: uefisecapp: Fix memory related IO errors and crashes", "id": "2281836", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2281836"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nfirmware: qcom: uefisecapp: Fix memory related IO errors and crashes\nIt turns out that while the QSEECOM APP_SEND command has specific fields\nfor request and response buffers, uefisecapp expects them both to be in\na single memory region. Failure to adhere to this has (so far) resulted\nin either no response being written to the response buffer (causing an\nEIO to be emitted down the line), the SCM call to fail with EINVAL\n(i.e., directly from TZ/firmware), or the device to be hard-reset.\nWhile this issue can be triggered deterministically, in the current form\nit seems to happen rather sporadically (which is why it has gone\nunnoticed during earlier testing). This is likely due to the two\nkzalloc() calls (for request and response) being directly after each\nother. Which means that those likely return consecutive regions most of\nthe time, especially when not much else is going on in the system.\nFix this by allocating a single memory region for both request and\nresponse buffers, properly aligning both structs inside it. This\nunfortunately also means that the qcom_scm_qseecom_app_send() interface\nneeds to be restructured, as it should no longer map the DMA regions\nseparately. Therefore, move the responsibility of DMA allocation (or\nmapping) to the caller.", "A vulnerability was found in the Qualcomm firmware driver (`qcom_qseecom_uefisecapp`) in the Linux kernel. It arises from incorrect memory allocation for request and response buffers in the QSEECOM APP_SEND command. The driver expects both buffers to be in a single memory region, but they are allocated separately, leading to potential issues such as no response being written (EIO error), failure of the SCM call (EINVAL), or device hard-reset. The issue is fixed by allocating a single memory region for both buffers, with DMA allocation responsibilities moved to the caller."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-35994", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-20T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-35994\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-35994\nhttps://lore.kernel.org/linux-cve-announce/2024052021-CVE-2024-35994-d606@gregkh/T"], "statement": "Red Hat Enterprise Linux is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux kernel used in its distributions.", "threat_severity": "Moderate"}

{"created": "2025-07-12T16:01:23.026104+00:00", "updated": "2025-07-12T16:01:23.026178+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}