CVE-2024-36016

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2024-36016", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-17T13:50:33.154Z", "datePublished": "2024-05-29T18:46:34.778Z", "dateUpdated": "2026-08-05T11:31:37.096Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:31:37.096Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: n_gsm: fix possible out-of-bounds in gsm0_receive()\n\nAssuming the following:\n- side A configures the n_gsm in basic option mode\n- side B sends the header of a basic option mode frame with data length 1\n- side A switches to advanced option mode\n- side B sends 2 data bytes which exceeds gsm->len\n Reason: gsm->len is not used in advanced option mode.\n- side A switches to basic option mode\n- side B keeps sending until gsm0_receive() writes past gsm->buf\n Reason: Neither gsm->state nor gsm->len have been reset after\n reconfiguration.\n\nFix this by changing gsm->count to gsm->len comparison from equal to less\nthan. Also add upper limit checks against the constant MAX_MRU in\ngsm0_receive() and gsm1_receive() to harden against memory corruption of\ngsm->len and gsm->mru.\n\nAll other checks remain as we still need to limit the data according to the\nuser configuration and actual payload size."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation is entirely local \u2014 the attacker opens /dev/ptmx, attaches the N_GSM0710 line discipline via TIOCSETD, drives mode switches with the GSMIOC_SETCONF ioctl, and feeds the malicious byte stream by writing to the pty master. No network or physical access is involved.\nAC:L - The attacker controls both sides of the pty pair, so the exact sequence (fill count in advanced mode, reconfigure to basic mode, keep writing) is deterministic and requires no race or unpredictable memory state. A tested proof of concept was attached to the upstream bug report (bugzilla 218708).\nPR:L - Across most of the affected range (2.6.35 through 6.5, and stable trees prior to the Aug-2023 backport of 67c37756898a), attaching N_GSM0710 required no privileges whatsoever, and GSMIOC_SETCONF has no capability check at all \u2014 so a plain unprivileged local account with a pty is sufficient.\nUI:N - The attacker performs every step \u2014 ldisc attach, reconfiguration, and data injection \u2014 without any action by another user or victim process.\nS:U - The heap corruption occurs in kernel memory belonging to the same security authority as the kernel itself; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The desynced count/len are also used by gsm_fcs_add_block() and dlci->data(dlci, gsm->buf, gsm->len), producing out-of-bounds reads whose contents are delivered into DLCI tty buffers the attacker can read back, and the heap overflow primitive can be leveraged for broader kernel memory disclosure.\nI:H - This is an unbounded linear heap buffer overflow past a 1501-byte kmalloc'd object with fully attacker-controlled bytes and attacker-chosen length, giving control over adjacent kmalloc-2k slab objects \u2014 a strong primitive for arbitrary write and control-flow hijacking.\nA:H - Overwriting arbitrary amounts of adjacent slab memory reliably corrupts kernel data structures and slab metadata, causing oops or panic; the reporter observed memory corruption in practice."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/tty/n_gsm.c"], "versions": [{"version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0", "lessThan": "9513d4148950b05bc99fa7314dc883cc0e1605e5", "status": "affected", "versionType": "git"}, {"version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0", "lessThan": "b229bc6c6ea9fe459fc3fa94fd0a27a2f32aca56", "status": "affected", "versionType": "git"}, {"version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0", "lessThan": "0fb736c9931e02dbc7d9a75044c8e1c039e50f04", "status": "affected", "versionType": "git"}, {"version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0", "lessThan": "4c267110fc110390704cc065edb9817fdd10ff54", "status": "affected", "versionType": "git"}, {"version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0", "lessThan": "46f52c89a7e7d2691b97a9728e4591d071ca8abc", "status": "affected", "versionType": "git"}, {"version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0", "lessThan": "774d83b008eccb1c48c14dc5486e7aa255731350", "status": "affected", "versionType": "git"}, {"version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0", "lessThan": "f126ce7305fe88f49cdabc6db4168b9318898ea3", "status": "affected", "versionType": "git"}, {"version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0", "lessThan": "b890d45aaf02b564e6cae2d2a590f9649330857d", "status": "affected", "versionType": "git"}, {"version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0", "lessThan": "47388e807f85948eefc403a8a5fdc5b406a65d5a", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/tty/n_gsm.c"], "versions": [{"version": "2.6.35", "status": "affected"}, {"version": "0", "lessThan": "2.6.35", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.316", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.278", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.219", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.161", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.93", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.33", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.12", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9.3", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "4.19.316"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "5.4.278"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "5.10.219"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "5.15.161"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "6.1.93"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "6.6.33"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "6.8.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "6.9.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.35", "versionEndExcluding": "6.10"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/9513d4148950b05bc99fa7314dc883cc0e1605e5"}, {"url": "https://git.kernel.org/stable/c/b229bc6c6ea9fe459fc3fa94fd0a27a2f32aca56"}, {"url": "https://git.kernel.org/stable/c/0fb736c9931e02dbc7d9a75044c8e1c039e50f04"}, {"url": "https://git.kernel.org/stable/c/4c267110fc110390704cc065edb9817fdd10ff54"}, {"url": "https://git.kernel.org/stable/c/46f52c89a7e7d2691b97a9728e4591d071ca8abc"}, {"url": "https://git.kernel.org/stable/c/774d83b008eccb1c48c14dc5486e7aa255731350"}, {"url": "https://git.kernel.org/stable/c/f126ce7305fe88f49cdabc6db4168b9318898ea3"}, {"url": "https://git.kernel.org/stable/c/b890d45aaf02b564e6cae2d2a590f9649330857d"}, {"url": "https://git.kernel.org/stable/c/47388e807f85948eefc403a8a5fdc5b406a65d5a"}], "title": "tty: n_gsm: fix possible out-of-bounds in gsm0_receive()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-125", "lang": "en", "description": "CWE-125 Out-of-bounds Read"}]}], "affected": [{"vendor": "linux", "product": "linux_kernel", "cpes": ["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "e1eaea46bb40", "status": "affected", "lessThan": "b890d45aaf02", "versionType": "custom"}]}, {"vendor": "linux", "product": "linux_kernel", "cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "e1eaea46bb40", "status": "affected", "lessThan": "47388e807f85", "versionType": "custom"}]}, {"vendor": "linux", "product": "linux_kernel", "cpes": ["cpe:2.3:o:linux:linux_kernel:2.6.35:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "2.6.35", "status": "affected"}]}, {"vendor": "linux", "product": "linux_kernel", "cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "e1eaea46bb40", "status": "affected", "lessThan": "f126ce7305fe", "versionType": "custom"}, {"version": "e1eaea46bb40", "status": "affected", "lessThan": "9513d4148950", "versionType": "custom"}, {"version": "e1eaea46bb40", "status": "affected", "lessThan": "b229bc6c6ea9", "versionType": "custom"}, {"version": "e1eaea46bb40", "status": "affected", "lessThan": "0fb736c9931e", "versionType": "custom"}, {"version": "e1eaea46bb40", "status": "affected", "lessThan": "4c267110fc11", "versionType": "custom"}, {"version": "e1eaea46bb40", "status": "affected", "lessThanOrEqual": "46f52c89a7e7", "versionType": "custom"}, {"version": "e1eaea46bb40", "status": "affected", "lessThan": "774d83b008ec", "versionType": "custom"}, {"version": "0", "status": "unaffected", "lessThan": "2.6.35", "versionType": "custom"}, {"version": "4.19.316", "status": "unaffected", "lessThanOrEqual": "4.20", "versionType": "custom"}, {"version": "5.4.278", "status": "unaffected", "lessThanOrEqual": "5.5", "versionType": "custom"}, {"version": "5.10.219", "status": "unaffected", "lessThanOrEqual": "5.11", "versionType": "custom"}, {"version": "5.15.161", "status": "unaffected", "lessThanOrEqual": "5.16", "versionType": "custom"}, {"version": "6.1.93", "status": "unaffected", "lessThanOrEqual": "6.2", "versionType": "custom"}, {"version": "6.6.33", "status": "unaffected", "lessThanOrEqual": "6.7", "versionType": "custom"}, {"version": "6.8.12", "status": "unaffected", "lessThanOrEqual": "6.9", "versionType": "custom"}, {"version": "6.9.3", "status": "unaffected", "lessThanOrEqual": "6.10", "versionType": "custom"}, {"version": "6.10", "status": "unaffected", "lessThanOrEqual": "*", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-05-30T18:00:26.164343Z", "id": "CVE-2024-36016", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-22T17:58:33.311Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/9513d4148950b05bc99fa7314dc883cc0e1605e5", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b229bc6c6ea9fe459fc3fa94fd0a27a2f32aca56", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0fb736c9931e02dbc7d9a75044c8e1c039e50f04", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4c267110fc110390704cc065edb9817fdd10ff54", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/46f52c89a7e7d2691b97a9728e4591d071ca8abc", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/774d83b008eccb1c48c14dc5486e7aa255731350", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/f126ce7305fe88f49cdabc6db4168b9318898ea3", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b890d45aaf02b564e6cae2d2a590f9649330857d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/47388e807f85948eefc403a8a5fdc5b406a65d5a", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T17:20:57.711Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/9513d4148950b05bc99fa7314dc883cc0e1605e5", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b229bc6c6ea9fe459fc3fa94fd0a27a2f32aca56", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0fb736c9931e02dbc7d9a75044c8e1c039e50f04", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4c267110fc110390704cc065edb9817fdd10ff54", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/46f52c89a7e7d2691b97a9728e4591d071ca8abc", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/774d83b008eccb1c48c14dc5486e7aa255731350", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/f126ce7305fe88f49cdabc6db4168b9318898ea3", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b890d45aaf02b564e6cae2d2a590f9649330857d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/47388e807f85948eefc403a8a5fdc5b406a65d5a", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T17:20:57.711Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-36016", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-30T18:00:26.164343Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "affected", "version": "e1eaea46bb40", "lessThan": "b890d45aaf02", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "affected", "version": "e1eaea46bb40", "lessThan": "47388e807f85", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:2.6.35:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "affected", "version": "2.6.35"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "affected", "version": "e1eaea46bb40", "lessThan": "f126ce7305fe", "versionType": "custom"}, {"status": "affected", "version": "e1eaea46bb40", "lessThan": "9513d4148950", "versionType": "custom"}, {"status": "affected", "version": "e1eaea46bb40", "lessThan": "b229bc6c6ea9", "versionType": "custom"}, {"status": "affected", "version": "e1eaea46bb40", "lessThan": "0fb736c9931e", "versionType": "custom"}, {"status": "affected", "version": "e1eaea46bb40", "lessThan": "4c267110fc11", "versionType": "custom"}, {"status": "affected", "version": "e1eaea46bb40", "versionType": "custom", "lessThanOrEqual": "46f52c89a7e7"}, {"status": "affected", "version": "e1eaea46bb40", "lessThan": "774d83b008ec", "versionType": "custom"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.35", "versionType": "custom"}, {"status": "unaffected", "version": "4.19.316", "versionType": "custom", "lessThanOrEqual": "4.20"}, {"status": "unaffected", "version": "5.4.278", "versionType": "custom", "lessThanOrEqual": "5.5"}, {"status": "unaffected", "version": "5.10.219", "versionType": "custom", "lessThanOrEqual": "5.11"}, {"status": "unaffected", "version": "5.15.161", "versionType": "custom", "lessThanOrEqual": "5.16"}, {"status": "unaffected", "version": "6.1.93", "versionType": "custom", "lessThanOrEqual": "6.2"}, {"status": "unaffected", "version": "6.6.33", "versionType": "custom", "lessThanOrEqual": "6.7"}, {"status": "unaffected", "version": "6.8.12", "versionType": "custom", "lessThanOrEqual": "6.9"}, {"status": "unaffected", "version": "6.9.3", "versionType": "custom", "lessThanOrEqual": "6.10"}, {"status": "unaffected", "version": "6.10", "versionType": "custom", "lessThanOrEqual": "*"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-30T18:11:07.936Z"}}], "cna": {"title": "tty: n_gsm: fix possible out-of-bounds in gsm0_receive()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0", "lessThan": "9513d4148950b05bc99fa7314dc883cc0e1605e5", "versionType": "git"}, {"status": "affected", "version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0", "lessThan": "b229bc6c6ea9fe459fc3fa94fd0a27a2f32aca56", "versionType": "git"}, {"status": "affected", "version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0", "lessThan": "0fb736c9931e02dbc7d9a75044c8e1c039e50f04", "versionType": "git"}, {"status": "affected", "version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0", "lessThan": "4c267110fc110390704cc065edb9817fdd10ff54", "versionType": "git"}, {"status": "affected", "version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0", "lessThan": "46f52c89a7e7d2691b97a9728e4591d071ca8abc", "versionType": "git"}, {"status": "affected", "version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0", "lessThan": "774d83b008eccb1c48c14dc5486e7aa255731350", "versionType": "git"}, {"status": "affected", "version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0", "lessThan": "f126ce7305fe88f49cdabc6db4168b9318898ea3", "versionType": "git"}, {"status": "affected", "version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0", "lessThan": "b890d45aaf02b564e6cae2d2a590f9649330857d", "versionType": "git"}, {"status": "affected", "version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0", "lessThan": "47388e807f85948eefc403a8a5fdc5b406a65d5a", "versionType": "git"}], "programFiles": ["drivers/tty/n_gsm.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.35"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.35", "versionType": "semver"}, {"status": "unaffected", "version": "4.19.316", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.278", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.219", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.161", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.93", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.33", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.8.12", "versionType": "semver", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9.3", "versionType": "semver", "lessThanOrEqual": "6.9.*"}, {"status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/tty/n_gsm.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/9513d4148950b05bc99fa7314dc883cc0e1605e5"}, {"url": "https://git.kernel.org/stable/c/b229bc6c6ea9fe459fc3fa94fd0a27a2f32aca56"}, {"url": "https://git.kernel.org/stable/c/0fb736c9931e02dbc7d9a75044c8e1c039e50f04"}, {"url": "https://git.kernel.org/stable/c/4c267110fc110390704cc065edb9817fdd10ff54"}, {"url": "https://git.kernel.org/stable/c/46f52c89a7e7d2691b97a9728e4591d071ca8abc"}, {"url": "https://git.kernel.org/stable/c/774d83b008eccb1c48c14dc5486e7aa255731350"}, {"url": "https://git.kernel.org/stable/c/f126ce7305fe88f49cdabc6db4168b9318898ea3"}, {"url": "https://git.kernel.org/stable/c/b890d45aaf02b564e6cae2d2a590f9649330857d"}, {"url": "https://git.kernel.org/stable/c/47388e807f85948eefc403a8a5fdc5b406a65d5a"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: n_gsm: fix possible out-of-bounds in gsm0_receive()\n\nAssuming the following:\n- side A configures the n_gsm in basic option mode\n- side B sends the header of a basic option mode frame with data length 1\n- side A switches to advanced option mode\n- side B sends 2 data bytes which exceeds gsm->len\n Reason: gsm->len is not used in advanced option mode.\n- side A switches to basic option mode\n- side B keeps sending until gsm0_receive() writes past gsm->buf\n Reason: Neither gsm->state nor gsm->len have been reset after\n reconfiguration.\n\nFix this by changing gsm->count to gsm->len comparison from equal to less\nthan. Also add upper limit checks against the constant MAX_MRU in\ngsm0_receive() and gsm1_receive() to harden against memory corruption of\ngsm->len and gsm->mru.\n\nAll other checks remain as we still need to limit the data according to the\nuser configuration and actual payload size."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.316", "versionStartIncluding": "2.6.35"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.278", "versionStartIncluding": "2.6.35"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.219", "versionStartIncluding": "2.6.35"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.161", "versionStartIncluding": "2.6.35"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.93", "versionStartIncluding": "2.6.35"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.33", "versionStartIncluding": "2.6.35"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8.12", "versionStartIncluding": "2.6.35"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9.3", "versionStartIncluding": "2.6.35"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10", "versionStartIncluding": "2.6.35"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-04T09:24:38.139Z"}}}, "cveMetadata": {"cveId": "CVE-2024-36016", "state": "PUBLISHED", "dateUpdated": "2026-08-04T09:24:38.139Z", "dateReserved": "2024-05-17T13:50:33.154Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-29T18:46:34.778Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/tty/n_gsm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "9513d4148950b05bc99fa7314dc883cc0e1605e5", "status": "affected", "version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0", "versionType": "git"}, {"lessThan": "b229bc6c6ea9fe459fc3fa94fd0a27a2f32aca56", "status": "affected", "version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0", "versionType": "git"}, {"lessThan": "0fb736c9931e02dbc7d9a75044c8e1c039e50f04", "status": "affected", "version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0", "versionType": "git"}, {"lessThan": "4c267110fc110390704cc065edb9817fdd10ff54", "status": "affected", "version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0", "versionType": "git"}, {"lessThan": "46f52c89a7e7d2691b97a9728e4591d071ca8abc", "status": "affected", "version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0", "versionType": "git"}, {"lessThan": "774d83b008eccb1c48c14dc5486e7aa255731350", "status": "affected", "version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0", "versionType": "git"}, {"lessThan": "f126ce7305fe88f49cdabc6db4168b9318898ea3", "status": "affected", "version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0", "versionType": "git"}, {"lessThan": "b890d45aaf02b564e6cae2d2a590f9649330857d", "status": "affected", "version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0", "versionType": "git"}, {"lessThan": "47388e807f85948eefc403a8a5fdc5b406a65d5a", "status": "affected", "version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/tty/n_gsm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.35"}, {"lessThan": "2.6.35", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.316", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.278", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.219", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.161", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.93", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.33", "versionType": "semver"}, {"lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.12", "versionType": "semver"}, {"lessThanOrEqual": "6.9.*", "status": "unaffected", "version": "6.9.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"cpes": ["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [{"lessThan": "b890d45aaf02", "status": "affected", "version": "e1eaea46bb40", "versionType": "custom"}]}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [{"lessThan": "47388e807f85", "status": "affected", "version": "e1eaea46bb40", "versionType": "custom"}]}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:2.6.35:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [{"status": "affected", "version": "2.6.35"}]}, {"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [{"lessThan": "f126ce7305fe", "status": "affected", "version": "e1eaea46bb40", "versionType": "custom"}, {"lessThan": "9513d4148950", "status": "affected", "version": "e1eaea46bb40", "versionType": "custom"}, {"lessThan": "b229bc6c6ea9", "status": "affected", "version": "e1eaea46bb40", "versionType": "custom"}, {"lessThan": "0fb736c9931e", "status": "affected", "version": "e1eaea46bb40", "versionType": "custom"}, {"lessThan": "4c267110fc11", "status": "affected", "version": "e1eaea46bb40", "versionType": "custom"}, {"lessThanOrEqual": "46f52c89a7e7", "status": "affected", "version": "e1eaea46bb40", "versionType": "custom"}, {"lessThan": "774d83b008ec", "status": "affected", "version": "e1eaea46bb40", "versionType": "custom"}, {"lessThan": "2.6.35", "status": "unaffected", "version": "0", "versionType": "custom"}, {"lessThanOrEqual": "4.20", "status": "unaffected", "version": "4.19.316", "versionType": "custom"}, {"lessThanOrEqual": "5.5", "status": "unaffected", "version": "5.4.278", "versionType": "custom"}, {"lessThanOrEqual": "5.11", "status": "unaffected", "version": "5.10.219", "versionType": "custom"}, {"lessThanOrEqual": "5.16", "status": "unaffected", "version": "5.15.161", "versionType": "custom"}, {"lessThanOrEqual": "6.2", "status": "unaffected", "version": "6.1.93", "versionType": "custom"}, {"lessThanOrEqual": "6.7", "status": "unaffected", "version": "6.6.33", "versionType": "custom"}, {"lessThanOrEqual": "6.9", "status": "unaffected", "version": "6.8.12", "versionType": "custom"}, {"lessThanOrEqual": "6.10", "status": "unaffected", "version": "6.9.3", "versionType": "custom"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.10", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1BF99E52-091D-4D39-8639-6E3471FEBD3A", "versionEndExcluding": "4.19.316", "versionStartIncluding": "2.6.35", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7FDBF235-DA18-49A1-8690-6C7272FD0701", "versionEndExcluding": "5.4.278", "versionStartIncluding": "4.20", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E9063AF3-D593-43B7-810D-58B87F82F9F9", "versionEndExcluding": "5.10.219", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "31130639-53FE-4726-8986-434EE2528CB2", "versionEndExcluding": "5.15.161", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "EEFB78EE-F990-4197-BF1C-156760A55667", "versionEndExcluding": "6.1.93", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FCE796DF-3B50-4DC6-BAE5-95271068FC9E", "versionEndExcluding": "6.6.33", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "80550309-67AB-4FD1-AC07-3DED5C4F01B2", "versionEndExcluding": "6.8.12", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E07124C1-19E8-4D21-828D-9932A01D3011", "versionEndExcluding": "6.9.3", "versionStartIncluding": "6.9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: n_gsm: fix possible out-of-bounds in gsm0_receive()\n\nAssuming the following:\n- side A configures the n_gsm in basic option mode\n- side B sends the header of a basic option mode frame with data length 1\n- side A switches to advanced option mode\n- side B sends 2 data bytes which exceeds gsm->len\n Reason: gsm->len is not used in advanced option mode.\n- side A switches to basic option mode\n- side B keeps sending until gsm0_receive() writes past gsm->buf\n Reason: Neither gsm->state nor gsm->len have been reset after\n reconfiguration.\n\nFix this by changing gsm->count to gsm->len comparison from equal to less\nthan. Also add upper limit checks against the constant MAX_MRU in\ngsm0_receive() and gsm1_receive() to harden against memory corruption of\ngsm->len and gsm->mru.\n\nAll other checks remain as we still need to limit the data according to the\nuser configuration and actual payload size."}, {"lang": "es", "value": "En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: tty: n_gsm: corrige posibles fuera de los l\u00edmites en gsm0_receive() Suponiendo lo siguiente: - el lado A configura el n_gsm en modo de opci\u00f3n b\u00e1sica - el lado B env\u00eda el encabezado de un mensaje b\u00e1sico trama del modo de opci\u00f3n con longitud de datos 1 - el lado A cambia al modo de opci\u00f3n avanzada - el lado B env\u00eda 2 bytes de datos que exceden gsm->len Motivo: gsm->len no se usa en el modo de opci\u00f3n avanzada. - el lado A cambia al modo de opci\u00f3n b\u00e1sica - el lado B contin\u00faa enviando hasta que gsm0_receive() escribe m\u00e1s all\u00e1 de gsm->buf Motivo: Ni gsm->state ni gsm->len se han restablecido despu\u00e9s de la reconfiguraci\u00f3n. Solucione este problema cambiando gsm->count a gsm->len comparaci\u00f3n de igual a menor que. Tambi\u00e9n agregue comprobaciones de l\u00edmite superior contra la constante MAX_MRU en gsm0_receive() y gsm1_receive() para proteger contra la corrupci\u00f3n de memoria de gsm->len y gsm->mru. Todas las dem\u00e1s comprobaciones permanecen, ya que todav\u00eda necesitamos limitar los datos seg\u00fan la configuraci\u00f3n del usuario y el tama\u00f1o real del payload."}], "id": "CVE-2024-36016", "lastModified": "2026-08-04T11:18:22.827", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-36016", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-05-30T18:00:26.164343Z", "version": "2.0.3"}}]}, "published": "2024-05-29T19:15:48.297", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0fb736c9931e02dbc7d9a75044c8e1c039e50f04"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/46f52c89a7e7d2691b97a9728e4591d071ca8abc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/47388e807f85948eefc403a8a5fdc5b406a65d5a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4c267110fc110390704cc065edb9817fdd10ff54"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/774d83b008eccb1c48c14dc5486e7aa255731350"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9513d4148950b05bc99fa7314dc883cc0e1605e5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b229bc6c6ea9fe459fc3fa94fd0a27a2f32aca56"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b890d45aaf02b564e6cae2d2a590f9649330857d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f126ce7305fe88f49cdabc6db4168b9318898ea3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0fb736c9931e02dbc7d9a75044c8e1c039e50f04"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/46f52c89a7e7d2691b97a9728e4591d071ca8abc"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/47388e807f85948eefc403a8a5fdc5b406a65d5a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4c267110fc110390704cc065edb9817fdd10ff54"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/774d83b008eccb1c48c14dc5486e7aa255731350"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9513d4148950b05bc99fa7314dc883cc0e1605e5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b229bc6c6ea9fe459fc3fa94fd0a27a2f32aca56"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b890d45aaf02b564e6cae2d2a590f9649330857d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f126ce7305fe88f49cdabc6db4168b9318898ea3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2024:5102", "cpe": "cpe:/a:redhat:enterprise_linux:8::nfv", "package": "kernel-rt-0:4.18.0-553.16.1.rt7.357.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-08-08T00:00:00Z"}, {"advisory": "RHSA-2024:5101", "cpe": "cpe:/o:redhat:enterprise_linux:8", "package": "kernel-0:4.18.0-553.16.1.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-08-08T00:00:00Z"}, {"advisory": "RHSA-2024:5692", "cpe": "cpe:/o:redhat:rhel_aus:8.6", "package": "kernel-0:4.18.0-372.119.1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "release_date": "2024-08-21T00:00:00Z"}, {"advisory": "RHSA-2024:5692", "cpe": "cpe:/o:redhat:rhel_tus:8.6", "package": "kernel-0:4.18.0-372.119.1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "release_date": "2024-08-21T00:00:00Z"}, {"advisory": "RHSA-2024:5692", "cpe": "cpe:/o:redhat:rhel_e4s:8.6", "package": "kernel-0:4.18.0-372.119.1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "release_date": "2024-08-21T00:00:00Z"}, {"advisory": "RHSA-2024:6993", "cpe": "cpe:/o:redhat:rhel_eus:8.8", "package": "kernel-0:4.18.0-477.74.1.el8_8", "product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support", "release_date": "2024-09-24T00:00:00Z"}, {"advisory": "RHSA-2024:6997", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-427.37.1.el9_4", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-09-24T00:00:00Z"}, {"advisory": "RHSA-2024:6997", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-427.37.1.el9_4", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-09-24T00:00:00Z"}, {"advisory": "RHSA-2024:4533", "cpe": "cpe:/a:redhat:rhel_eus:9.2", "package": "kernel-0:5.14.0-284.73.1.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2024-07-15T00:00:00Z"}, {"advisory": "RHSA-2024:4554", "cpe": "cpe:/a:redhat:rhel_eus:9.2::nfv", "package": "kernel-rt-0:5.14.0-284.73.1.rt14.358.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2024-07-15T00:00:00Z"}], "bugzilla": {"description": "kernel: tty: n_gsm: fix possible out-of-bounds in gsm0_receive()", "id": "2283894", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2283894"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.4", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ntty: n_gsm: fix possible out-of-bounds in gsm0_receive()\nAssuming the following:\n- side A configures the n_gsm in basic option mode\n- side B sends the header of a basic option mode frame with data length 1\n- side A switches to advanced option mode\n- side B sends 2 data bytes which exceeds gsm->len\nReason: gsm->len is not used in advanced option mode.\n- side A switches to basic option mode\n- side B keeps sending until gsm0_receive() writes past gsm->buf\nReason: Neither gsm->state nor gsm->len have been reset after\nreconfiguration.\nFix this by changing gsm->count to gsm->len comparison from equal to less\nthan. Also add upper limit checks against the constant MAX_MRU in\ngsm0_receive() and gsm1_receive() to harden against memory corruption of\ngsm->len and gsm->mru.\nAll other checks remain as we still need to limit the data according to the\nuser configuration and actual payload size.", "A vulnerability was found in the Linux kernel's `n_gsm` driver, affecting the `tty` subsystem. It occurs when switching between basic and advanced option modes in GSM multiplexing, leading to potential out-of-bounds memory writes. This happens because certain state variables, like `gsm->len` and `gsm->state`, are not properly reset during mode changes. The issue could result in memory corruption."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-36016", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-29T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-36016\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-36016\nhttps://lore.kernel.org/linux-cve-announce/2024052947-CVE-2024-36016-d30a@gregkh/T"], "threat_severity": "Moderate"}

{}