CVE-2024-38635

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-38635", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-06-18T19:36:34.947Z", "datePublished": "2024-06-21T10:18:24.244Z", "dateUpdated": "2026-10-15T00:43:50.068Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:33:17.807Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoundwire: cadence: fix invalid PDI offset\n\nFor some reason, we add an offset to the PDI, presumably to skip the\nPDI0 and PDI1 which are reserved for BPT.\n\nThis code is however completely wrong and leads to an out-of-bounds\naccess. We were just lucky so far since we used only a couple of PDIs\nand remained within the PDI array bounds.\n\nA Fixes: tag is not provided since there are no known platforms where\nthe out-of-bounds would be accessed, and the initial code had problems\nas well.\n\nA follow-up patch completely removes this useless offset."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is reached only through the ALSA PCM device node (`/dev/snd/pcmC*D*`) via `SNDRV_PCM_IOCTL_HW_PARAMS`, which funnels into the ASoC DAI `.hw_params` callback `intel_hw_params()` and then `sdw_cdns_alloc_pdi()`. This requires local access to the machine; there is no network or adjacent-network path to a SoundWire manager DAI.\nAC:L - The out-of-bounds walk is unconditional arithmetic (`i = 2; i < 2 + num_bd`) with no race, no timing window, and no dependency on memory layout to occur \u2014 an attacker simply configures hw_params on a bidirectional-PDI DAI and the read past the array happens deterministically. Heap grooming to make the adjacent slab object's first word match the small `dai_id` value, and thus convert the read into the OOB write, is standard and repeatable since the attacker can retry the ioctl arbitrarily many times.\nPR:L - The attacker needs no capabilities, only the ability to open a PCM device \u2014 granted to ordinary desktop users via the `audio` group or logind seat ACLs, and to ordinary apps in Android's audio domain. No CAP_SYS_ADMIN, CAP_SYS_RAWIO, or root check exists anywhere on the path from the ioctl to `cdns_find_pdi()`.\nUI:N - The attacker performs the entire sequence itself \u2014 open the PCM device and issue HW_PARAMS with a chosen channel count \u2014 with no victim action, no filesystem mount, and no file opened by another user.\nS:U - The out-of-bounds read and write both occur in kernel heap memory within the same kernel security authority; nothing crosses a VM, IOMMU, or sandbox boundary.\nC:H - The loop reads `pdi[num_bd].num` and `pdi[num_bd+1].num` from beyond the `devm_kcalloc()` allocation, and the resulting out-of-bounds pointer is stored in `dai_runtime->pdi` and used to source values (`num`, `intel_alh_id`, `ch_count`) that are programmed into SHIM/ALH/Cadence registers, leaking adjacent kernel heap contents; per kernel guidance, heap memory corruption of this kind is leverageable for information disclosure.\nI:H - When the out-of-bounds `num` matches `dai_id`, `sdw_cdns_alloc_pdi()` writes five fields (`l_ch_num`, `h_ch_num`, `ch_count`, `dir`, and later `intel_alh_id`) through the out-of-bounds pointer, corrupting roughly 20 bytes of the neighbouring slab object with values partly controlled by the attacker-supplied channel count. A heap out-of-bounds write with attacker-influenced data is a classic primitive for control-flow hijack via heap grooming.\nA:H - The out-of-bounds access trips KASAN/hardened-usercopy checks and, on production kernels, corrupts adjacent slab metadata or a neighbouring object, readily producing an oops or panic; the stale out-of-bounds `dai_runtime->pdi` pointer is re-dereferenced in `.prepare`, `.trigger`, and `.hw_free`, compounding the crash potential."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/soundwire/cadence_master.c"], "versions": [{"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "002364b2d594a9afc0385c09e00994c510b1d089", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "fd4bcb991ebaf0d1813d81d9983cfa99f9ef5328", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "902f6d656441a511ac25c6cffce74496db10a078", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "2ebcaa0e5db9b6044bb487ae1cf41bc601761567", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "7eeef1e935d23db5265233d92395bd5c648a4021", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "4e99103f757cdf636c6ee860994a19a346a11785", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "8ee1b439b1540ae543149b15a2a61b9dff937d91", "status": "affected", "versionType": "git"}, {"version": "0", "lessThan": "5.4.278", "status": "affected", "versionType": "semver"}, {"version": "0", "lessThan": "5.10.219", "status": "affected", "versionType": "semver"}, {"version": "0", "lessThan": "5.15.161", "status": "affected", "versionType": "semver"}, {"version": "0", "lessThan": "6.1.93", "status": "affected", "versionType": "semver"}, {"version": "0", "lessThan": "6.6.33", "status": "affected", "versionType": "semver"}, {"version": "0", "lessThan": "6.9.4", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/soundwire/cadence_master.c"], "versions": [{"version": "5.4.278", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.219", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.161", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.93", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.33", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9.4", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "5.4.278"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "5.10.219"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "5.15.161"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.1.93"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.6.33"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.9.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.10"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/002364b2d594a9afc0385c09e00994c510b1d089"}, {"url": "https://git.kernel.org/stable/c/fd4bcb991ebaf0d1813d81d9983cfa99f9ef5328"}, {"url": "https://git.kernel.org/stable/c/902f6d656441a511ac25c6cffce74496db10a078"}, {"url": "https://git.kernel.org/stable/c/2ebcaa0e5db9b6044bb487ae1cf41bc601761567"}, {"url": "https://git.kernel.org/stable/c/7eeef1e935d23db5265233d92395bd5c648a4021"}, {"url": "https://git.kernel.org/stable/c/4e99103f757cdf636c6ee860994a19a346a11785"}, {"url": "https://git.kernel.org/stable/c/8ee1b439b1540ae543149b15a2a61b9dff937d91"}], "title": "soundwire: cadence: fix invalid PDI offset", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-21T13:12:09.388099Z", "id": "CVE-2024-38635", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-21T13:12:24.572Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:12:26.040Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/002364b2d594a9afc0385c09e00994c510b1d089", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/fd4bcb991ebaf0d1813d81d9983cfa99f9ef5328", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/902f6d656441a511ac25c6cffce74496db10a078", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/2ebcaa0e5db9b6044bb487ae1cf41bc601761567", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/7eeef1e935d23db5265233d92395bd5c648a4021", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4e99103f757cdf636c6ee860994a19a346a11785", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8ee1b439b1540ae543149b15a2a61b9dff937d91", "tags": ["x_transferred"]}]}, {"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T00:43:50.068Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.1.1", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/002364b2d594a9afc0385c09e00994c510b1d089", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/fd4bcb991ebaf0d1813d81d9983cfa99f9ef5328", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/902f6d656441a511ac25c6cffce74496db10a078", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/2ebcaa0e5db9b6044bb487ae1cf41bc601761567", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/7eeef1e935d23db5265233d92395bd5c648a4021", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4e99103f757cdf636c6ee860994a19a346a11785", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8ee1b439b1540ae543149b15a2a61b9dff937d91", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:12:26.040Z"}}, {"affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.1.1", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T00:43:50.068Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-38635", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-21T13:12:09.388099Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-21T13:12:21.134Z"}}], "cna": {"title": "soundwire: cadence: fix invalid PDI offset", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is reached only through the ALSA PCM device node (`/dev/snd/pcmC*D*`) via `SNDRV_PCM_IOCTL_HW_PARAMS`, which funnels into the ASoC DAI `.hw_params` callback `intel_hw_params()` and then `sdw_cdns_alloc_pdi()`. This requires local access to the machine; there is no network or adjacent-network path to a SoundWire manager DAI.\nAC:L - The out-of-bounds walk is unconditional arithmetic (`i = 2; i < 2 + num_bd`) with no race, no timing window, and no dependency on memory layout to occur \u2014 an attacker simply configures hw_params on a bidirectional-PDI DAI and the read past the array happens deterministically. Heap grooming to make the adjacent slab object's first word match the small `dai_id` value, and thus convert the read into the OOB write, is standard and repeatable since the attacker can retry the ioctl arbitrarily many times.\nPR:L - The attacker needs no capabilities, only the ability to open a PCM device \u2014 granted to ordinary desktop users via the `audio` group or logind seat ACLs, and to ordinary apps in Android's audio domain. No CAP_SYS_ADMIN, CAP_SYS_RAWIO, or root check exists anywhere on the path from the ioctl to `cdns_find_pdi()`.\nUI:N - The attacker performs the entire sequence itself \u2014 open the PCM device and issue HW_PARAMS with a chosen channel count \u2014 with no victim action, no filesystem mount, and no file opened by another user.\nS:U - The out-of-bounds read and write both occur in kernel heap memory within the same kernel security authority; nothing crosses a VM, IOMMU, or sandbox boundary.\nC:H - The loop reads `pdi[num_bd].num` and `pdi[num_bd+1].num` from beyond the `devm_kcalloc()` allocation, and the resulting out-of-bounds pointer is stored in `dai_runtime->pdi` and used to source values (`num`, `intel_alh_id`, `ch_count`) that are programmed into SHIM/ALH/Cadence registers, leaking adjacent kernel heap contents; per kernel guidance, heap memory corruption of this kind is leverageable for information disclosure.\nI:H - When the out-of-bounds `num` matches `dai_id`, `sdw_cdns_alloc_pdi()` writes five fields (`l_ch_num`, `h_ch_num`, `ch_count`, `dir`, and later `intel_alh_id`) through the out-of-bounds pointer, corrupting roughly 20 bytes of the neighbouring slab object with values partly controlled by the attacker-supplied channel count. A heap out-of-bounds write with attacker-influenced data is a classic primitive for control-flow hijack via heap grooming.\nA:H - The out-of-bounds access trips KASAN/hardened-usercopy checks and, on production kernels, corrupts adjacent slab metadata or a neighbouring object, readily producing an oops or panic; the stale out-of-bounds `dai_runtime->pdi` pointer is re-dereferenced in `.prepare`, `.trigger`, and `.hw_free`, compounding the crash potential."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "002364b2d594a9afc0385c09e00994c510b1d089", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "fd4bcb991ebaf0d1813d81d9983cfa99f9ef5328", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "902f6d656441a511ac25c6cffce74496db10a078", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "2ebcaa0e5db9b6044bb487ae1cf41bc601761567", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "7eeef1e935d23db5265233d92395bd5c648a4021", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "4e99103f757cdf636c6ee860994a19a346a11785", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "8ee1b439b1540ae543149b15a2a61b9dff937d91", "versionType": "git"}, {"status": "affected", "version": "0", "lessThan": "5.4.278", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "5.10.219", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "5.15.161", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "6.1.93", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "6.6.33", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "6.9.4", "versionType": "semver"}], "programFiles": ["drivers/soundwire/cadence_master.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "unaffected", "version": "5.4.278", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.219", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.161", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.93", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.33", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.9.4", "versionType": "semver", "lessThanOrEqual": "6.9.*"}, {"status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/soundwire/cadence_master.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/002364b2d594a9afc0385c09e00994c510b1d089"}, {"url": "https://git.kernel.org/stable/c/fd4bcb991ebaf0d1813d81d9983cfa99f9ef5328"}, {"url": "https://git.kernel.org/stable/c/902f6d656441a511ac25c6cffce74496db10a078"}, {"url": "https://git.kernel.org/stable/c/2ebcaa0e5db9b6044bb487ae1cf41bc601761567"}, {"url": "https://git.kernel.org/stable/c/7eeef1e935d23db5265233d92395bd5c648a4021"}, {"url": "https://git.kernel.org/stable/c/4e99103f757cdf636c6ee860994a19a346a11785"}, {"url": "https://git.kernel.org/stable/c/8ee1b439b1540ae543149b15a2a61b9dff937d91"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoundwire: cadence: fix invalid PDI offset\n\nFor some reason, we add an offset to the PDI, presumably to skip the\nPDI0 and PDI1 which are reserved for BPT.\n\nThis code is however completely wrong and leads to an out-of-bounds\naccess. We were just lucky so far since we used only a couple of PDIs\nand remained within the PDI array bounds.\n\nA Fixes: tag is not provided since there are no known platforms where\nthe out-of-bounds would be accessed, and the initial code had problems\nas well.\n\nA follow-up patch completely removes this useless offset."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.278"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.219"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.161"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.93"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.33"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:33:17.807Z"}}}, "cveMetadata": {"cveId": "CVE-2024-38635", "state": "PUBLISHED", "dateUpdated": "2026-10-15T00:43:50.068Z", "dateReserved": "2024-06-18T19:36:34.947Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-06-21T10:18:24.244Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/soundwire/cadence_master.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "002364b2d594a9afc0385c09e00994c510b1d089", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "fd4bcb991ebaf0d1813d81d9983cfa99f9ef5328", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "902f6d656441a511ac25c6cffce74496db10a078", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "2ebcaa0e5db9b6044bb487ae1cf41bc601761567", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "7eeef1e935d23db5265233d92395bd5c648a4021", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "4e99103f757cdf636c6ee860994a19a346a11785", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "8ee1b439b1540ae543149b15a2a61b9dff937d91", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "5.4.278", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "5.10.219", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "5.15.161", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "6.1.93", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "6.6.33", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "6.9.4", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/soundwire/cadence_master.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.278", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.219", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.161", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.93", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.33", "versionType": "semver"}, {"lessThanOrEqual": "6.9.*", "status": "unaffected", "version": "6.9.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "V1.1.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2B755DA3-6492-4165-BE2F-55FB23D6D019", "versionEndExcluding": "5.4.278", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E9063AF3-D593-43B7-810D-58B87F82F9F9", "versionEndExcluding": "5.10.219", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "31130639-53FE-4726-8986-434EE2528CB2", "versionEndExcluding": "5.15.161", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "EEFB78EE-F990-4197-BF1C-156760A55667", "versionEndExcluding": "6.1.93", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FCE796DF-3B50-4DC6-BAE5-95271068FC9E", "versionEndExcluding": "6.6.33", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "991B9791-966A-4D18-9E8D-A8AB128E5627", "versionEndExcluding": "6.9.4", "versionStartIncluding": "6.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoundwire: cadence: fix invalid PDI offset\n\nFor some reason, we add an offset to the PDI, presumably to skip the\nPDI0 and PDI1 which are reserved for BPT.\n\nThis code is however completely wrong and leads to an out-of-bounds\naccess. We were just lucky so far since we used only a couple of PDIs\nand remained within the PDI array bounds.\n\nA Fixes: tag is not provided since there are no known platforms where\nthe out-of-bounds would be accessed, and the initial code had problems\nas well.\n\nA follow-up patch completely removes this useless offset."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: soundwire: cadencia: corrige el desplazamiento de PDI no v\u00e1lido. Por alguna raz\u00f3n, agregamos un desplazamiento al PDI, presumiblemente para omitir el PDI0 y el PDI1 que est\u00e1n reservados para BPT. Sin embargo, este c\u00f3digo es completamente err\u00f3neo y conduce a un acceso fuera de los l\u00edmites. Hasta ahora tuvimos suerte ya que solo usamos un par de PDI y nos mantuvimos dentro de los l\u00edmites de la matriz de PDI. No se proporciona una etiqueta de Correcciones: ya que no hay plataformas conocidas donde se pueda acceder a los l\u00edmites, y el c\u00f3digo inicial tambi\u00e9n ten\u00eda problemas. Un parche de seguimiento elimina por completo esta compensaci\u00f3n in\u00fatil."}], "id": "CVE-2024-38635", "lastModified": "2026-10-15T01:18:32.300", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-38635", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-06-21T13:12:09.388099Z", "version": "2.0.3"}}]}, "published": "2024-06-21T11:15:12.240", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/002364b2d594a9afc0385c09e00994c510b1d089"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2ebcaa0e5db9b6044bb487ae1cf41bc601761567"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4e99103f757cdf636c6ee860994a19a346a11785"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7eeef1e935d23db5265233d92395bd5c648a4021"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8ee1b439b1540ae543149b15a2a61b9dff937d91"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/902f6d656441a511ac25c6cffce74496db10a078"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fd4bcb991ebaf0d1813d81d9983cfa99f9ef5328"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/002364b2d594a9afc0385c09e00994c510b1d089"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2ebcaa0e5db9b6044bb487ae1cf41bc601761567"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4e99103f757cdf636c6ee860994a19a346a11785"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7eeef1e935d23db5265233d92395bd5c648a4021"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8ee1b439b1540ae543149b15a2a61b9dff937d91"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/902f6d656441a511ac25c6cffce74496db10a078"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fd4bcb991ebaf0d1813d81d9983cfa99f9ef5328"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2024:9315", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.11.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-11-12T00:00:00Z"}, {"advisory": "RHSA-2024:9315", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.11.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-11-12T00:00:00Z"}], "bugzilla": {"description": "kernel: soundwire: cadence: fix invalid PDI offset", "id": "2293693", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2293693"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nsoundwire: cadence: fix invalid PDI offset\nFor some reason, we add an offset to the PDI, presumably to skip the\nPDI0 and PDI1 which are reserved for BPT.\nThis code is however completely wrong and leads to an out-of-bounds\naccess. We were just lucky so far since we used only a couple of PDIs\nand remained within the PDI array bounds.\nA Fixes: tag is not provided since there are no known platforms where\nthe out-of-bounds would be accessed, and the initial code had problems\nas well.\nA follow-up patch completely removes this useless offset."], "name": "CVE-2024-38635", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-06-21T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-38635\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-38635\nhttps://lore.kernel.org/linux-cve-announce/2024062143-CVE-2024-38635-a3b1@gregkh/T"], "threat_severity": "Moderate"}

{}