CVE-2024-35994 (GCVE-0-2024-35994)
Vulnerability from cvelistv5
Published
2024-05-20 09:47
Modified
2026-08-05 11:31
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
firmware: qcom: uefisecapp: Fix memory related IO errors and crashes
It turns out that while the QSEECOM APP_SEND command has specific fields
for request and response buffers, uefisecapp expects them both to be in
a single memory region. Failure to adhere to this has (so far) resulted
in either no response being written to the response buffer (causing an
EIO to be emitted down the line), the SCM call to fail with EINVAL
(i.e., directly from TZ/firmware), or the device to be hard-reset.
While this issue can be triggered deterministically, in the current form
it seems to happen rather sporadically (which is why it has gone
unnoticed during earlier testing). This is likely due to the two
kzalloc() calls (for request and response) being directly after each
other. Which means that those likely return consecutive regions most of
the time, especially when not much else is going on in the system.
Fix this by allocating a single memory region for both request and
response buffers, properly aligning both structs inside it. This
unfortunately also means that the qcom_scm_qseecom_app_send() interface
needs to be restructured, as it should no longer map the DMA regions
separately. Therefore, move the responsibility of DMA allocation (or
mapping) to the caller.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-35994",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-20T14:05:44.255812Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:33:52.169Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:30:11.569Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/dd22b34fb53cb04b13b2f5eee5c9200bb091fc88"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/ed09f81eeaa8f9265e1787282cb283f10285c259"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/firmware/qcom/qcom_qseecom_uefisecapp.c",
"drivers/firmware/qcom/qcom_scm.c",
"include/linux/firmware/qcom/qcom_qseecom.h",
"include/linux/firmware/qcom/qcom_scm.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "dd22b34fb53cb04b13b2f5eee5c9200bb091fc88",
"status": "affected",
"version": "759e7a2b62eb3ef3c93ffeb5cca788a09627d7d9",
"versionType": "git"
},
{
"lessThan": "ed09f81eeaa8f9265e1787282cb283f10285c259",
"status": "affected",
"version": "759e7a2b62eb3ef3c93ffeb5cca788a09627d7d9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/firmware/qcom/qcom_qseecom_uefisecapp.c",
"drivers/firmware/qcom/qcom_scm.c",
"include/linux/firmware/qcom/qcom_qseecom.h",
"include/linux/firmware/qcom/qcom_scm.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.8.*",
"status": "unaffected",
"version": "6.8.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.9",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.8.9",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.9",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: qcom: uefisecapp: Fix memory related IO errors and crashes\n\nIt turns out that while the QSEECOM APP_SEND command has specific fields\nfor request and response buffers, uefisecapp expects them both to be in\na single memory region. Failure to adhere to this has (so far) resulted\nin either no response being written to the response buffer (causing an\nEIO to be emitted down the line), the SCM call to fail with EINVAL\n(i.e., directly from TZ/firmware), or the device to be hard-reset.\n\nWhile this issue can be triggered deterministically, in the current form\nit seems to happen rather sporadically (which is why it has gone\nunnoticed during earlier testing). This is likely due to the two\nkzalloc() calls (for request and response) being directly after each\nother. Which means that those likely return consecutive regions most of\nthe time, especially when not much else is going on in the system.\n\nFix this by allocating a single memory region for both request and\nresponse buffers, properly aligning both structs inside it. This\nunfortunately also means that the qcom_scm_qseecom_app_send() interface\nneeds to be restructured, as it should no longer map the DMA regions\nseparately. Therefore, move the responsibility of DMA allocation (or\nmapping) to the caller."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached through the local efivarfs filesystem (`read()` on /sys/firmware/efi/efivars/*), which drives the qcuefi efivar operations; there is no network or remote path to uefisecapp.\nAC:L - The commit states the issue \"can be triggered deterministically\" \u2014 it merely looks sporadic because idle-system slab behaviour happens to place the two kzalloc()s adjacently, and an attacker fully controls slab layout via concurrent allocation pressure, parallel readers, and choice of which variable (hence which kmalloc bucket) to read.\nPR:L - efivarfs contains no capable()/CAP_* checks whatsoever and creates variable files mode 0644 under a 0755 directory, so any local unprivileged user can read an EFI variable and drive the buggy request/response allocation pair twice per read().\nUI:N - The attacker triggers the path entirely from their own process by reading efivarfs files; no action by any other user or administrator is needed.\nS:U - The corruption and the reset both land on the same device under the kernel\u0027s own security authority; although the secure world is involved, this is scored as standard kernel-local impact rather than a VM/IOMMU boundary escape.\nC:H - When the buffers are non-contiguous the secure world reads and writes normal-world memory outside the regions the kernel allocated and mapped for it, giving out-of-bounds access to adjacent kernel slab objects that can be groomed and leveraged for kernel memory disclosure.\nI:H - The documented failure mode where \"no response [is] written to the response buffer\" means uefisecapp wrote the response into kernel memory outside the allocated response buffer \u2014 an out-of-bounds write by a higher-privileged agent into an attacker-groomable slab neighbour, which is exploitable for kernel memory corruption.\nA:H - The commit explicitly documents that the mismatch can cause \"the device to be hard-reset\", a full SoC reset, and the SCM/EIO failures also render the EFI variable interface unusable."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T11:31:28.204Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/dd22b34fb53cb04b13b2f5eee5c9200bb091fc88"
},
{
"url": "https://git.kernel.org/stable/c/ed09f81eeaa8f9265e1787282cb283f10285c259"
}
],
"title": "firmware: qcom: uefisecapp: Fix memory related IO errors and crashes",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-35994",
"datePublished": "2024-05-20T09:47:58.396Z",
"dateReserved": "2024-05-17T13:50:33.147Z",
"dateUpdated": "2026-08-05T11:31:28.204Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/dd22b34fb53cb04b13b2f5eee5c9200bb091fc88\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/ed09f81eeaa8f9265e1787282cb283f10285c259\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:30:11.569Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-35994\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-20T14:05:44.255812Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:24.744Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"firmware: qcom: uefisecapp: Fix memory related IO errors and crashes\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable code is reached through the local efivarfs filesystem (`read()` on /sys/firmware/efi/efivars/*), which drives the qcuefi efivar operations; there is no network or remote path to uefisecapp.\\nAC:L - The commit states the issue \\\"can be triggered deterministically\\\" \\u2014 it merely looks sporadic because idle-system slab behaviour happens to place the two kzalloc()s adjacently, and an attacker fully controls slab layout via concurrent allocation pressure, parallel readers, and choice of which variable (hence which kmalloc bucket) to read.\\nPR:L - efivarfs contains no capable()/CAP_* checks whatsoever and creates variable files mode 0644 under a 0755 directory, so any local unprivileged user can read an EFI variable and drive the buggy request/response allocation pair twice per read().\\nUI:N - The attacker triggers the path entirely from their own process by reading efivarfs files; no action by any other user or administrator is needed.\\nS:U - The corruption and the reset both land on the same device under the kernel\u0027s own security authority; although the secure world is involved, this is scored as standard kernel-local impact rather than a VM/IOMMU boundary escape.\\nC:H - When the buffers are non-contiguous the secure world reads and writes normal-world memory outside the regions the kernel allocated and mapped for it, giving out-of-bounds access to adjacent kernel slab objects that can be groomed and leveraged for kernel memory disclosure.\\nI:H - The documented failure mode where \\\"no response [is] written to the response buffer\\\" means uefisecapp wrote the response into kernel memory outside the allocated response buffer \\u2014 an out-of-bounds write by a higher-privileged agent into an attacker-groomable slab neighbour, which is exploitable for kernel memory corruption.\\nA:H - The commit explicitly documents that the mismatch can cause \\\"the device to be hard-reset\\\", a full SoC reset, and the SCM/EIO failures also render the EFI variable interface unusable.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"759e7a2b62eb3ef3c93ffeb5cca788a09627d7d9\", \"lessThan\": \"dd22b34fb53cb04b13b2f5eee5c9200bb091fc88\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"759e7a2b62eb3ef3c93ffeb5cca788a09627d7d9\", \"lessThan\": \"ed09f81eeaa8f9265e1787282cb283f10285c259\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/firmware/qcom/qcom_qseecom_uefisecapp.c\", \"drivers/firmware/qcom/qcom_scm.c\", \"include/linux/firmware/qcom/qcom_qseecom.h\", \"include/linux/firmware/qcom/qcom_scm.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.8.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/firmware/qcom/qcom_qseecom_uefisecapp.c\", \"drivers/firmware/qcom/qcom_scm.c\", \"include/linux/firmware/qcom/qcom_qseecom.h\", \"include/linux/firmware/qcom/qcom_scm.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/dd22b34fb53cb04b13b2f5eee5c9200bb091fc88\"}, {\"url\": \"https://git.kernel.org/stable/c/ed09f81eeaa8f9265e1787282cb283f10285c259\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfirmware: qcom: uefisecapp: Fix memory related IO errors and crashes\\n\\nIt turns out that while the QSEECOM APP_SEND command has specific fields\\nfor request and response buffers, uefisecapp expects them both to be in\\na single memory region. Failure to adhere to this has (so far) resulted\\nin either no response being written to the response buffer (causing an\\nEIO to be emitted down the line), the SCM call to fail with EINVAL\\n(i.e., directly from TZ/firmware), or the device to be hard-reset.\\n\\nWhile this issue can be triggered deterministically, in the current form\\nit seems to happen rather sporadically (which is why it has gone\\nunnoticed during earlier testing). This is likely due to the two\\nkzalloc() calls (for request and response) being directly after each\\nother. Which means that those likely return consecutive regions most of\\nthe time, especially when not much else is going on in the system.\\n\\nFix this by allocating a single memory region for both request and\\nresponse buffers, properly aligning both structs inside it. This\\nunfortunately also means that the qcom_scm_qseecom_app_send() interface\\nneeds to be restructured, as it should no longer map the DMA regions\\nseparately. Therefore, move the responsibility of DMA allocation (or\\nmapping) to the caller.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.9\", \"versionStartIncluding\": \"6.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"6.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:31:28.204Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-35994\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:31:28.204Z\", \"dateReserved\": \"2024-05-17T13:50:33.147Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-20T09:47:58.396Z\", \"assignerShortName\": \"Linux\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…