CVE-2024-36965

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-36965", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-30T15:25:07.081Z", "datePublished": "2024-06-08T12:52:58.404Z", "dateUpdated": "2026-08-05T11:32:20.070Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:32:20.070Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nremoteproc: mediatek: Make sure IPI buffer fits in L2TCM\n\nThe IPI buffer location is read from the firmware that we load to the\nSystem Companion Processor, and it's not granted that both the SRAM\n(L2TCM) size that is defined in the devicetree node is large enough\nfor that, and while this is especially true for multi-core SCP, it's\nstill useful to check on single-core variants as well.\n\nFailing to perform this check may make this driver perform R/W\noperations out of the L2TCM boundary, resulting (at best) in a\nkernel panic.\n\nTo fix that, check that the IPI buffer fits, otherwise return a\nfailure and refuse to boot the relevant SCP core (or the SCP at\nall, if this is single core)."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is reached by local means only \u2014 an unprivileged open() of /dev/video* (mtk-vcodec) or a write to /sys/class/remoteproc/*/state, with the firmware image read from the local filesystem. There is no network or remote-peer input involved.\nAC:L - The out-of-range `.ipi_buffer` sh_addr is a static, deterministic property of the loaded firmware image, so once the vulnerable configuration exists the OOB access happens 100% of the time; where the attacker supplies the image, the offset is directly and fully attacker-chosen. No race, no memory grooming, no unpredictable precondition.\nPR:L - An unprivileged local user with access to the V4L2 codec node (video group, standard on ChromeOS/Android MediaTek devices) triggers rproc_boot() \u2192 scp_parse_fw() \u2192 scp_ipi_init() by simply opening /dev/video0, and subsequently drives userspace-influenced data through the out-of-bounds send_buf via IPI. No capability or root is needed to reach the unvalidated code.\nUI:N - The attacker performs the triggering open()/ioctl sequence itself; no victim action is required, and on default configurations rproc->auto_boot even runs the path unattended at probe.\nS:U - The out-of-bounds reads and writes land in the kernel's own ioremap/vmalloc address space and are handled entirely by the kernel's security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - scp_ipi_handler() performs readl()/memcpy_fromio() from the out-of-bounds recv_buf and hands up to ~600 bytes of that out-of-range memory to registered IPI handlers, whose contents surface to userspace through vcodec/rpmsg \u2014 an unbounded kernel-address-space read primitive controlled by the offset.\nI:H - scp_ipi_init() memset_io()s past the L2TCM mapping, and scp_ipi_send() writes up to a full IPI payload of userspace-influenced bytes at sram_base+offset \u2014 an out-of-bounds write at an offset reachable across a 4GB range of the kernel's vmalloc/ioremap region, able to corrupt neighbouring MMIO registers, the other SCP core's L2TCM, or other vmalloc'd kernel objects.\nA:H - The commit message states the unchecked R/W past the L2TCM boundary results \"(at best) in a kernel panic\"; touching unmapped ioremap VA raises an unrecoverable data abort, and the resulting corruption can hang or crash the system, reproducible on every boot/open."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/remoteproc/mtk_scp.c"], "versions": [{"version": "3efa0ea743b77d1611501f7d8b4f320d032d73ae", "lessThan": "00548ac6b14428719c970ef90adae2b3b48c0cdf", "status": "affected", "versionType": "git"}, {"version": "3efa0ea743b77d1611501f7d8b4f320d032d73ae", "lessThan": "1d9e2de24533daca36cbf09e8d8596bf72b526b2", "status": "affected", "versionType": "git"}, {"version": "3efa0ea743b77d1611501f7d8b4f320d032d73ae", "lessThan": "26c6d7dc8c6a9fde9d362ab2eef6390efeff145e", "status": "affected", "versionType": "git"}, {"version": "3efa0ea743b77d1611501f7d8b4f320d032d73ae", "lessThan": "838b49e211d59fa827ff9df062d4020917cffbdf", "status": "affected", "versionType": "git"}, {"version": "3efa0ea743b77d1611501f7d8b4f320d032d73ae", "lessThan": "36c79eb4845551e9f6d28c663b38ce0ab03b84a9", "status": "affected", "versionType": "git"}, {"version": "3efa0ea743b77d1611501f7d8b4f320d032d73ae", "lessThan": "331f91d86f71d0bb89a44217cc0b2a22810bbd42", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/remoteproc/mtk_scp.c"], "versions": [{"version": "5.11", "status": "affected"}, {"version": "0", "lessThan": "5.11", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.160", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.92", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.32", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.11", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9.2", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "5.15.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.1.92"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.6.32"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.8.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.9.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.10"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/00548ac6b14428719c970ef90adae2b3b48c0cdf"}, {"url": "https://git.kernel.org/stable/c/1d9e2de24533daca36cbf09e8d8596bf72b526b2"}, {"url": "https://git.kernel.org/stable/c/26c6d7dc8c6a9fde9d362ab2eef6390efeff145e"}, {"url": "https://git.kernel.org/stable/c/838b49e211d59fa827ff9df062d4020917cffbdf"}, {"url": "https://git.kernel.org/stable/c/36c79eb4845551e9f6d28c663b38ce0ab03b84a9"}, {"url": "https://git.kernel.org/stable/c/331f91d86f71d0bb89a44217cc0b2a22810bbd42"}], "title": "remoteproc: mediatek: Make sure IPI buffer fits in L2TCM", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:43:50.595Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/00548ac6b14428719c970ef90adae2b3b48c0cdf", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1d9e2de24533daca36cbf09e8d8596bf72b526b2", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/26c6d7dc8c6a9fde9d362ab2eef6390efeff145e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/838b49e211d59fa827ff9df062d4020917cffbdf", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/36c79eb4845551e9f6d28c663b38ce0ab03b84a9", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/331f91d86f71d0bb89a44217cc0b2a22810bbd42", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-36965", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:15:29.133298Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:58.958Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/00548ac6b14428719c970ef90adae2b3b48c0cdf", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1d9e2de24533daca36cbf09e8d8596bf72b526b2", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/26c6d7dc8c6a9fde9d362ab2eef6390efeff145e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/838b49e211d59fa827ff9df062d4020917cffbdf", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/36c79eb4845551e9f6d28c663b38ce0ab03b84a9", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/331f91d86f71d0bb89a44217cc0b2a22810bbd42", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:43:50.595Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-36965", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:15:29.133298Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:27.300Z"}}], "cna": {"title": "remoteproc: mediatek: Make sure IPI buffer fits in L2TCM", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3efa0ea743b77d1611501f7d8b4f320d032d73ae", "lessThan": "00548ac6b14428719c970ef90adae2b3b48c0cdf", "versionType": "git"}, {"status": "affected", "version": "3efa0ea743b77d1611501f7d8b4f320d032d73ae", "lessThan": "1d9e2de24533daca36cbf09e8d8596bf72b526b2", "versionType": "git"}, {"status": "affected", "version": "3efa0ea743b77d1611501f7d8b4f320d032d73ae", "lessThan": "26c6d7dc8c6a9fde9d362ab2eef6390efeff145e", "versionType": "git"}, {"status": "affected", "version": "3efa0ea743b77d1611501f7d8b4f320d032d73ae", "lessThan": "838b49e211d59fa827ff9df062d4020917cffbdf", "versionType": "git"}, {"status": "affected", "version": "3efa0ea743b77d1611501f7d8b4f320d032d73ae", "lessThan": "36c79eb4845551e9f6d28c663b38ce0ab03b84a9", "versionType": "git"}, {"status": "affected", "version": "3efa0ea743b77d1611501f7d8b4f320d032d73ae", "lessThan": "331f91d86f71d0bb89a44217cc0b2a22810bbd42", "versionType": "git"}], "programFiles": ["drivers/remoteproc/mtk_scp.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.11"}, {"status": "unaffected", "version": "0", "lessThan": "5.11", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.160", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.92", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.32", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.8.11", "versionType": "semver", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9.2", "versionType": "semver", "lessThanOrEqual": "6.9.*"}, {"status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/remoteproc/mtk_scp.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/00548ac6b14428719c970ef90adae2b3b48c0cdf"}, {"url": "https://git.kernel.org/stable/c/1d9e2de24533daca36cbf09e8d8596bf72b526b2"}, {"url": "https://git.kernel.org/stable/c/26c6d7dc8c6a9fde9d362ab2eef6390efeff145e"}, {"url": "https://git.kernel.org/stable/c/838b49e211d59fa827ff9df062d4020917cffbdf"}, {"url": "https://git.kernel.org/stable/c/36c79eb4845551e9f6d28c663b38ce0ab03b84a9"}, {"url": "https://git.kernel.org/stable/c/331f91d86f71d0bb89a44217cc0b2a22810bbd42"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nremoteproc: mediatek: Make sure IPI buffer fits in L2TCM\n\nThe IPI buffer location is read from the firmware that we load to the\nSystem Companion Processor, and it's not granted that both the SRAM\n(L2TCM) size that is defined in the devicetree node is large enough\nfor that, and while this is especially true for multi-core SCP, it's\nstill useful to check on single-core variants as well.\n\nFailing to perform this check may make this driver perform R/W\noperations out of the L2TCM boundary, resulting (at best) in a\nkernel panic.\n\nTo fix that, check that the IPI buffer fits, otherwise return a\nfailure and refuse to boot the relevant SCP core (or the SCP at\nall, if this is single core)."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.160", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.92", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.32", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8.11", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9.2", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10", "versionStartIncluding": "5.11"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T20:18:01.034Z"}}}, "cveMetadata": {"cveId": "CVE-2024-36965", "state": "PUBLISHED", "dateUpdated": "2026-05-11T20:18:01.034Z", "dateReserved": "2024-05-30T15:25:07.081Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-06-08T12:52:58.404Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/remoteproc/mtk_scp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "00548ac6b14428719c970ef90adae2b3b48c0cdf", "status": "affected", "version": "3efa0ea743b77d1611501f7d8b4f320d032d73ae", "versionType": "git"}, {"lessThan": "1d9e2de24533daca36cbf09e8d8596bf72b526b2", "status": "affected", "version": "3efa0ea743b77d1611501f7d8b4f320d032d73ae", "versionType": "git"}, {"lessThan": "26c6d7dc8c6a9fde9d362ab2eef6390efeff145e", "status": "affected", "version": "3efa0ea743b77d1611501f7d8b4f320d032d73ae", "versionType": "git"}, {"lessThan": "838b49e211d59fa827ff9df062d4020917cffbdf", "status": "affected", "version": "3efa0ea743b77d1611501f7d8b4f320d032d73ae", "versionType": "git"}, {"lessThan": "36c79eb4845551e9f6d28c663b38ce0ab03b84a9", "status": "affected", "version": "3efa0ea743b77d1611501f7d8b4f320d032d73ae", "versionType": "git"}, {"lessThan": "331f91d86f71d0bb89a44217cc0b2a22810bbd42", "status": "affected", "version": "3efa0ea743b77d1611501f7d8b4f320d032d73ae", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/remoteproc/mtk_scp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.11"}, {"lessThan": "5.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.160", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.92", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.32", "versionType": "semver"}, {"lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.11", "versionType": "semver"}, {"lessThanOrEqual": "6.9.*", "status": "unaffected", "version": "6.9.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "EB1227F5-B622-45F2-80C8-F94E3F45859D", "versionEndIncluding": "5.15.160", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D7E75569-629C-4E66-840F-75A9E1A870CB", "versionEndIncluding": "6.1.92", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9E9EFAF5-AF5B-459D-B215-645B1CE4A579", "versionEndIncluding": "6.6.32", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "73BBA055-7988-4EAB-8218-196DA874ED2A", "versionEndIncluding": "6.8.11", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6539B4CE-9805-42AB-AEAF-91ED579F0F01", "versionEndIncluding": "6.9.2", "versionStartIncluding": "6.9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nremoteproc: mediatek: Make sure IPI buffer fits in L2TCM\n\nThe IPI buffer location is read from the firmware that we load to the\nSystem Companion Processor, and it's not granted that both the SRAM\n(L2TCM) size that is defined in the devicetree node is large enough\nfor that, and while this is especially true for multi-core SCP, it's\nstill useful to check on single-core variants as well.\n\nFailing to perform this check may make this driver perform R/W\noperations out of the L2TCM boundary, resulting (at best) in a\nkernel panic.\n\nTo fix that, check that the IPI buffer fits, otherwise return a\nfailure and refuse to boot the relevant SCP core (or the SCP at\nall, if this is single core)."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: remoteproc: mediatek: aseg\u00farese de que el b\u00fafer IPI encaje en L2TCM. La ubicaci\u00f3n del b\u00fafer IPI se lee desde el firmware que cargamos en el procesador System Companion, y no se garantiza que tanto la SRAM ( L2TCM) que se define en el nodo del \u00e1rbol de dispositivos es lo suficientemente grande para eso, y si bien esto es especialmente cierto para SCP de m\u00faltiples n\u00facleos, tambi\u00e9n es \u00fatil verificar las variantes de un solo n\u00facleo. No realizar esta verificaci\u00f3n puede hacer que este controlador realice operaciones de lectura y escritura fuera del l\u00edmite L2TCM, lo que resultar\u00e1 (en el mejor de los casos) en un p\u00e1nico en el kernel. Para solucionarlo, verifique que el b\u00fafer IPI encaje; de lo contrario, devolver\u00e1 una falla y se negar\u00e1 a iniciar el n\u00facleo SCP relevante (o el SCP en absoluto, si es de un solo n\u00facleo)."}], "id": "CVE-2024-36965", "lastModified": "2026-08-04T11:18:35.877", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-36965", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T17:15:29.133298Z", "version": "2.0.3"}}]}, "published": "2024-06-08T13:15:57.820", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/00548ac6b14428719c970ef90adae2b3b48c0cdf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1d9e2de24533daca36cbf09e8d8596bf72b526b2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/26c6d7dc8c6a9fde9d362ab2eef6390efeff145e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/331f91d86f71d0bb89a44217cc0b2a22810bbd42"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/36c79eb4845551e9f6d28c663b38ce0ab03b84a9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/838b49e211d59fa827ff9df062d4020917cffbdf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/00548ac6b14428719c970ef90adae2b3b48c0cdf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1d9e2de24533daca36cbf09e8d8596bf72b526b2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/26c6d7dc8c6a9fde9d362ab2eef6390efeff145e"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/331f91d86f71d0bb89a44217cc0b2a22810bbd42"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/36c79eb4845551e9f6d28c663b38ce0ab03b84a9"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/838b49e211d59fa827ff9df062d4020917cffbdf"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: remoteproc: mediatek: Make sure IPI buffer fits in L2TCM", "id": "2292325", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2292325"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nremoteproc: mediatek: Make sure IPI buffer fits in L2TCM\nThe IPI buffer location is read from the firmware that we load to the\nSystem Companion Processor, and it's not granted that both the SRAM\n(L2TCM) size that is defined in the devicetree node is large enough\nfor that, and while this is especially true for multi-core SCP, it's\nstill useful to check on single-core variants as well.\nFailing to perform this check may make this driver perform R/W\noperations out of the L2TCM boundary, resulting (at best) in a\nkernel panic.\nTo fix that, check that the IPI buffer fits, otherwise return a\nfailure and refuse to boot the relevant SCP core (or the SCP at\nall, if this is single core).", "A vulnerability was found in the Linux kernel's MediaTek remote processor driver. The Inter-Processor Interrupt (IPI) buffers were not properly validated to ensure they fit within the L2 Tightly Coupled Memory (L2TCM). This issue could lead to buffer overflows or memory corruption."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-36965", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-06-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-36965\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-36965\nhttps://lore.kernel.org/linux-cve-announce/2024060801-CVE-2024-36965-dfe6@gregkh/T"], "statement": "Red Hat Enterprise Linux is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux kernel used in its distributions.", "threat_severity": "Moderate"}

{}