CVE-2024-43849

soc: qcom: pdr: protect locator_addr with the main mutex

Published Aug 17, 2024 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

soc: qcom: pdr: protect locator_addr with the main mutex

If the service locator server is restarted fast enough, the PDR can
rewrite locator_addr fields concurrently. Protect them by placing
modification of those fields under the main pdr->lock.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`fbe639b44a82755d639df1c5d147c93f02ac5a0f`	affected	< eab05737ee22216250fe20d27f5a596da5ea6eb7
`fbe639b44a82755d639df1c5d147c93f02ac5a0f`	affected	< d0870c4847e77a49c2f91bb2a8e0fa3c1f8dea5c
`fbe639b44a82755d639df1c5d147c93f02ac5a0f`	affected	< 475a77fb3f0e1d527f56c60b79f5879661df5b80
`fbe639b44a82755d639df1c5d147c93f02ac5a0f`	affected	< 3e815626d73e05152a8142f6e44aecc4133e6e08
`fbe639b44a82755d639df1c5d147c93f02ac5a0f`	affected	< 8543269567e2fb3d976a8255c5e348aed14f98bc
`fbe639b44a82755d639df1c5d147c93f02ac5a0f`	affected	< 107924c14e3ddd85119ca43c26a4ee1056fa9b84

Linux

affected

Version	Status	Constraints
`5.7`	affected	—
`0`	unaffected	< 5.7
`5.10.224`	unaffected	≤ 5.10.*
`5.15.165`	unaffected	≤ 5.15.*
`6.1.103`	unaffected	≤ 6.1.*
`6.6.44`	unaffected	≤ 6.6.*
`6.10.3`	unaffected	≤ 6.10.*
`6.11`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-3912-1	linux security update
Debian DLA	DLA-4008-1	linux-6.1 security update
Ubuntu USN	USN-7100-1	Linux kernel vulnerabilities
Ubuntu USN	USN-7100-2	Linux kernel vulnerabilities
Ubuntu USN	USN-7123-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-7144-1	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-7154-1	Linux kernel vulnerabilities
Ubuntu USN	USN-7155-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-7156-1	Linux kernel (GKE) vulnerabilities
Ubuntu USN	USN-7154-2	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-7194-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-7196-1	Linux kernel (Azure) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.165% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://git.kernel.org/stable/c/107924c14e3ddd85119ca43c26a4ee1056fa9b84
https://git.kernel.org/stable/c/3e815626d73e05152a8142f6e44aecc4133e6e08
https://git.kernel.org/stable/c/475a77fb3f0e1d527f56c60b79f5879661df5b80
https://git.kernel.org/stable/c/8543269567e2fb3d976a8255c5e348aed14f98bc
https://git.kernel.org/stable/c/d0870c4847e77a49c2f91bb2a8e0fa3c1f8dea5c
https://git.kernel.org/stable/c/eab05737ee22216250fe20d27f5a596da5ea6eb7
https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html
https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
https://lore.kernel.org/linux-cve-announce/2024081732-CVE-2024-43849-fef0@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2024-43849
https://www.cve.org/CVERecord?id=CVE-2024-43849

History

Nov 3, 2025 10:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html

Oct 24, 2024 4:30 PM First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Linux Linux linux Kernel
Weaknesses		CWE-667
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
Metrics	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'}`

Sep 19, 2024 11:00 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-413
Metrics	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Sep 11, 2024 1:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 19, 2024 7:15 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2024081732-CVE-2024-43849-fef0@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2024-43849 https://www.cve.org/CVERecord?id=CVE-2024-43849
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Aug 19, 2024 4:45 AM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/d0870c4847e77a49c2f91bb2a8e0fa3c1f8dea5c https://git.kernel.org/stable/c/eab05737ee22216250fe20d27f5a596da5ea6eb7

Aug 17, 2024 9:30 AM Description updated. Title updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: soc: qcom: pdr: protect locator_addr with the main mutex If the service locator server is restarted fast enough, the PDR can rewrite locator_addr fields concurrently. Protect them by placing modification of those fields under the main pdr->lock.
Title		soc: qcom: pdr: protect locator_addr with the main mutex
References		https://git.kernel.org/stable/c/107924c14e3ddd85119ca43c26a4ee1056fa9b84 https://git.kernel.org/stable/c/3e815626d73e05152a8142f6e44aecc4133e6e08 https://git.kernel.org/stable/c/475a77fb3f0e1d527f56c60b79f5879661df5b80 https://git.kernel.org/stable/c/8543269567e2fb3d976a8255c5e348aed14f98bc