CVE-2024-36016 (GCVE-0-2024-36016)
Vulnerability from cvelistv5
Published
2024-05-29 18:46
Modified
2026-08-05 11:31
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: fix possible out-of-bounds in gsm0_receive() Assuming the following: - side A configures the n_gsm in basic option mode - side B sends the header of a basic option mode frame with data length 1 - side A switches to advanced option mode - side B sends 2 data bytes which exceeds gsm->len Reason: gsm->len is not used in advanced option mode. - side A switches to basic option mode - side B keeps sending until gsm0_receive() writes past gsm->buf Reason: Neither gsm->state nor gsm->len have been reset after reconfiguration. Fix this by changing gsm->count to gsm->len comparison from equal to less than. Also add upper limit checks against the constant MAX_MRU in gsm0_receive() and gsm1_receive() to harden against memory corruption of gsm->len and gsm->mru. All other checks remain as we still need to limit the data according to the user configuration and actual payload size.
References
Impacted products
Vendor Product Version
Linux Linux Version: e1eaea46bb4020b38a141b84f88565d4603f8dd0
Version: e1eaea46bb4020b38a141b84f88565d4603f8dd0
Version: e1eaea46bb4020b38a141b84f88565d4603f8dd0
Version: e1eaea46bb4020b38a141b84f88565d4603f8dd0
Version: e1eaea46bb4020b38a141b84f88565d4603f8dd0
Version: e1eaea46bb4020b38a141b84f88565d4603f8dd0
Version: e1eaea46bb4020b38a141b84f88565d4603f8dd0
Version: e1eaea46bb4020b38a141b84f88565d4603f8dd0
Version: e1eaea46bb4020b38a141b84f88565d4603f8dd0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "b890d45aaf02",
                "status": "affected",
                "version": "e1eaea46bb40",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "47388e807f85",
                "status": "affected",
                "version": "e1eaea46bb40",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:2.6.35:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "affected",
                "version": "2.6.35"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "f126ce7305fe",
                "status": "affected",
                "version": "e1eaea46bb40",
                "versionType": "custom"
              },
              {
                "lessThan": "9513d4148950",
                "status": "affected",
                "version": "e1eaea46bb40",
                "versionType": "custom"
              },
              {
                "lessThan": "b229bc6c6ea9",
                "status": "affected",
                "version": "e1eaea46bb40",
                "versionType": "custom"
              },
              {
                "lessThan": "0fb736c9931e",
                "status": "affected",
                "version": "e1eaea46bb40",
                "versionType": "custom"
              },
              {
                "lessThan": "4c267110fc11",
                "status": "affected",
                "version": "e1eaea46bb40",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "46f52c89a7e7",
                "status": "affected",
                "version": "e1eaea46bb40",
                "versionType": "custom"
              },
              {
                "lessThan": "774d83b008ec",
                "status": "affected",
                "version": "e1eaea46bb40",
                "versionType": "custom"
              },
              {
                "lessThan": "2.6.35",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "4.20",
                "status": "unaffected",
                "version": "4.19.316",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "5.5",
                "status": "unaffected",
                "version": "5.4.278",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "5.11",
                "status": "unaffected",
                "version": "5.10.219",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "5.16",
                "status": "unaffected",
                "version": "5.15.161",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "6.2",
                "status": "unaffected",
                "version": "6.1.93",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "6.7",
                "status": "unaffected",
                "version": "6.6.33",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "6.9",
                "status": "unaffected",
                "version": "6.8.12",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "6.10",
                "status": "unaffected",
                "version": "6.9.3",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "6.10",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-36016",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-30T18:00:26.164343Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "CWE-125 Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-22T17:58:33.311Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:20:57.711Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9513d4148950b05bc99fa7314dc883cc0e1605e5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b229bc6c6ea9fe459fc3fa94fd0a27a2f32aca56"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0fb736c9931e02dbc7d9a75044c8e1c039e50f04"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4c267110fc110390704cc065edb9817fdd10ff54"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/46f52c89a7e7d2691b97a9728e4591d071ca8abc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/774d83b008eccb1c48c14dc5486e7aa255731350"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f126ce7305fe88f49cdabc6db4168b9318898ea3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b890d45aaf02b564e6cae2d2a590f9649330857d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/47388e807f85948eefc403a8a5fdc5b406a65d5a"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/tty/n_gsm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9513d4148950b05bc99fa7314dc883cc0e1605e5",
              "status": "affected",
              "version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0",
              "versionType": "git"
            },
            {
              "lessThan": "b229bc6c6ea9fe459fc3fa94fd0a27a2f32aca56",
              "status": "affected",
              "version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0",
              "versionType": "git"
            },
            {
              "lessThan": "0fb736c9931e02dbc7d9a75044c8e1c039e50f04",
              "status": "affected",
              "version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0",
              "versionType": "git"
            },
            {
              "lessThan": "4c267110fc110390704cc065edb9817fdd10ff54",
              "status": "affected",
              "version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0",
              "versionType": "git"
            },
            {
              "lessThan": "46f52c89a7e7d2691b97a9728e4591d071ca8abc",
              "status": "affected",
              "version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0",
              "versionType": "git"
            },
            {
              "lessThan": "774d83b008eccb1c48c14dc5486e7aa255731350",
              "status": "affected",
              "version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0",
              "versionType": "git"
            },
            {
              "lessThan": "f126ce7305fe88f49cdabc6db4168b9318898ea3",
              "status": "affected",
              "version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0",
              "versionType": "git"
            },
            {
              "lessThan": "b890d45aaf02b564e6cae2d2a590f9649330857d",
              "status": "affected",
              "version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0",
              "versionType": "git"
            },
            {
              "lessThan": "47388e807f85948eefc403a8a5fdc5b406a65d5a",
              "status": "affected",
              "version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/tty/n_gsm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.35"
            },
            {
              "lessThan": "2.6.35",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.316",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.278",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.219",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.161",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.316",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.278",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.219",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.161",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.93",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.33",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.12",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.3",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: n_gsm: fix possible out-of-bounds in gsm0_receive()\n\nAssuming the following:\n- side A configures the n_gsm in basic option mode\n- side B sends the header of a basic option mode frame with data length 1\n- side A switches to advanced option mode\n- side B sends 2 data bytes which exceeds gsm-\u003elen\n  Reason: gsm-\u003elen is not used in advanced option mode.\n- side A switches to basic option mode\n- side B keeps sending until gsm0_receive() writes past gsm-\u003ebuf\n  Reason: Neither gsm-\u003estate nor gsm-\u003elen have been reset after\n  reconfiguration.\n\nFix this by changing gsm-\u003ecount to gsm-\u003elen comparison from equal to less\nthan. Also add upper limit checks against the constant MAX_MRU in\ngsm0_receive() and gsm1_receive() to harden against memory corruption of\ngsm-\u003elen and gsm-\u003emru.\n\nAll other checks remain as we still need to limit the data according to the\nuser configuration and actual payload size."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation is entirely local \u2014 the attacker opens /dev/ptmx, attaches the N_GSM0710 line discipline via TIOCSETD, drives mode switches with the GSMIOC_SETCONF ioctl, and feeds the malicious byte stream by writing to the pty master. No network or physical access is involved.\nAC:L - The attacker controls both sides of the pty pair, so the exact sequence (fill count in advanced mode, reconfigure to basic mode, keep writing) is deterministic and requires no race or unpredictable memory state. A tested proof of concept was attached to the upstream bug report (bugzilla 218708).\nPR:L - Across most of the affected range (2.6.35 through 6.5, and stable trees prior to the Aug-2023 backport of 67c37756898a), attaching N_GSM0710 required no privileges whatsoever, and GSMIOC_SETCONF has no capability check at all \u2014 so a plain unprivileged local account with a pty is sufficient.\nUI:N - The attacker performs every step \u2014 ldisc attach, reconfiguration, and data injection \u2014 without any action by another user or victim process.\nS:U - The heap corruption occurs in kernel memory belonging to the same security authority as the kernel itself; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The desynced count/len are also used by gsm_fcs_add_block() and dlci-\u003edata(dlci, gsm-\u003ebuf, gsm-\u003elen), producing out-of-bounds reads whose contents are delivered into DLCI tty buffers the attacker can read back, and the heap overflow primitive can be leveraged for broader kernel memory disclosure.\nI:H - This is an unbounded linear heap buffer overflow past a 1501-byte kmalloc\u0027d object with fully attacker-controlled bytes and attacker-chosen length, giving control over adjacent kmalloc-2k slab objects \u2014 a strong primitive for arbitrary write and control-flow hijacking.\nA:H - Overwriting arbitrary amounts of adjacent slab memory reliably corrupts kernel data structures and slab metadata, causing oops or panic; the reporter observed memory corruption in practice."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:31:37.096Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9513d4148950b05bc99fa7314dc883cc0e1605e5"
        },
        {
          "url": "https://git.kernel.org/stable/c/b229bc6c6ea9fe459fc3fa94fd0a27a2f32aca56"
        },
        {
          "url": "https://git.kernel.org/stable/c/0fb736c9931e02dbc7d9a75044c8e1c039e50f04"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c267110fc110390704cc065edb9817fdd10ff54"
        },
        {
          "url": "https://git.kernel.org/stable/c/46f52c89a7e7d2691b97a9728e4591d071ca8abc"
        },
        {
          "url": "https://git.kernel.org/stable/c/774d83b008eccb1c48c14dc5486e7aa255731350"
        },
        {
          "url": "https://git.kernel.org/stable/c/f126ce7305fe88f49cdabc6db4168b9318898ea3"
        },
        {
          "url": "https://git.kernel.org/stable/c/b890d45aaf02b564e6cae2d2a590f9649330857d"
        },
        {
          "url": "https://git.kernel.org/stable/c/47388e807f85948eefc403a8a5fdc5b406a65d5a"
        }
      ],
      "title": "tty: n_gsm: fix possible out-of-bounds in gsm0_receive()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-36016",
    "datePublished": "2024-05-29T18:46:34.778Z",
    "dateReserved": "2024-05-17T13:50:33.154Z",
    "dateUpdated": "2026-08-05T11:31:37.096Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/9513d4148950b05bc99fa7314dc883cc0e1605e5\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/b229bc6c6ea9fe459fc3fa94fd0a27a2f32aca56\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0fb736c9931e02dbc7d9a75044c8e1c039e50f04\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/4c267110fc110390704cc065edb9817fdd10ff54\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/46f52c89a7e7d2691b97a9728e4591d071ca8abc\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/774d83b008eccb1c48c14dc5486e7aa255731350\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/f126ce7305fe88f49cdabc6db4168b9318898ea3\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/b890d45aaf02b564e6cae2d2a590f9649330857d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/47388e807f85948eefc403a8a5fdc5b406a65d5a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-04T17:20:57.711Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.7, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-36016\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-30T18:00:26.164343Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"e1eaea46bb40\", \"lessThan\": \"b890d45aaf02\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"e1eaea46bb40\", \"lessThan\": \"47388e807f85\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:2.6.35:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.35\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"e1eaea46bb40\", \"lessThan\": \"f126ce7305fe\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"e1eaea46bb40\", \"lessThan\": \"9513d4148950\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"e1eaea46bb40\", \"lessThan\": \"b229bc6c6ea9\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"e1eaea46bb40\", \"lessThan\": \"0fb736c9931e\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"e1eaea46bb40\", \"lessThan\": \"4c267110fc11\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"e1eaea46bb40\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"46f52c89a7e7\"}, {\"status\": \"affected\", \"version\": \"e1eaea46bb40\", \"lessThan\": \"774d83b008ec\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.35\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"4.19.316\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.20\"}, {\"status\": \"unaffected\", \"version\": \"5.4.278\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.5\"}, {\"status\": \"unaffected\", \"version\": \"5.10.219\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.11\"}, {\"status\": \"unaffected\", \"version\": \"5.15.161\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.16\"}, {\"status\": \"unaffected\", \"version\": \"6.1.93\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.2\"}, {\"status\": \"unaffected\", \"version\": \"6.6.33\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.7\"}, {\"status\": \"unaffected\", \"version\": \"6.8.12\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.9\"}, {\"status\": \"unaffected\", \"version\": \"6.9.3\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.10\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"*\"}], \"defaultStatus\": \"unknown\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-125\", \"description\": \"CWE-125 Out-of-bounds Read\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-30T18:11:07.936Z\"}}], \"cna\": {\"title\": \"tty: n_gsm: fix possible out-of-bounds in gsm0_receive()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"e1eaea46bb4020b38a141b84f88565d4603f8dd0\", \"lessThan\": \"9513d4148950b05bc99fa7314dc883cc0e1605e5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e1eaea46bb4020b38a141b84f88565d4603f8dd0\", \"lessThan\": \"b229bc6c6ea9fe459fc3fa94fd0a27a2f32aca56\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e1eaea46bb4020b38a141b84f88565d4603f8dd0\", \"lessThan\": \"0fb736c9931e02dbc7d9a75044c8e1c039e50f04\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e1eaea46bb4020b38a141b84f88565d4603f8dd0\", \"lessThan\": \"4c267110fc110390704cc065edb9817fdd10ff54\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e1eaea46bb4020b38a141b84f88565d4603f8dd0\", \"lessThan\": \"46f52c89a7e7d2691b97a9728e4591d071ca8abc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e1eaea46bb4020b38a141b84f88565d4603f8dd0\", \"lessThan\": \"774d83b008eccb1c48c14dc5486e7aa255731350\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e1eaea46bb4020b38a141b84f88565d4603f8dd0\", \"lessThan\": \"f126ce7305fe88f49cdabc6db4168b9318898ea3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e1eaea46bb4020b38a141b84f88565d4603f8dd0\", \"lessThan\": \"b890d45aaf02b564e6cae2d2a590f9649330857d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e1eaea46bb4020b38a141b84f88565d4603f8dd0\", \"lessThan\": \"47388e807f85948eefc403a8a5fdc5b406a65d5a\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/tty/n_gsm.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.35\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.35\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.316\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.278\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.219\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.161\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.93\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.33\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/tty/n_gsm.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/9513d4148950b05bc99fa7314dc883cc0e1605e5\"}, {\"url\": \"https://git.kernel.org/stable/c/b229bc6c6ea9fe459fc3fa94fd0a27a2f32aca56\"}, {\"url\": \"https://git.kernel.org/stable/c/0fb736c9931e02dbc7d9a75044c8e1c039e50f04\"}, {\"url\": \"https://git.kernel.org/stable/c/4c267110fc110390704cc065edb9817fdd10ff54\"}, {\"url\": \"https://git.kernel.org/stable/c/46f52c89a7e7d2691b97a9728e4591d071ca8abc\"}, {\"url\": \"https://git.kernel.org/stable/c/774d83b008eccb1c48c14dc5486e7aa255731350\"}, {\"url\": \"https://git.kernel.org/stable/c/f126ce7305fe88f49cdabc6db4168b9318898ea3\"}, {\"url\": \"https://git.kernel.org/stable/c/b890d45aaf02b564e6cae2d2a590f9649330857d\"}, {\"url\": \"https://git.kernel.org/stable/c/47388e807f85948eefc403a8a5fdc5b406a65d5a\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntty: n_gsm: fix possible out-of-bounds in gsm0_receive()\\n\\nAssuming the following:\\n- side A configures the n_gsm in basic option mode\\n- side B sends the header of a basic option mode frame with data length 1\\n- side A switches to advanced option mode\\n- side B sends 2 data bytes which exceeds gsm-\u003elen\\n  Reason: gsm-\u003elen is not used in advanced option mode.\\n- side A switches to basic option mode\\n- side B keeps sending until gsm0_receive() writes past gsm-\u003ebuf\\n  Reason: Neither gsm-\u003estate nor gsm-\u003elen have been reset after\\n  reconfiguration.\\n\\nFix this by changing gsm-\u003ecount to gsm-\u003elen comparison from equal to less\\nthan. Also add upper limit checks against the constant MAX_MRU in\\ngsm0_receive() and gsm1_receive() to harden against memory corruption of\\ngsm-\u003elen and gsm-\u003emru.\\n\\nAll other checks remain as we still need to limit the data according to the\\nuser configuration and actual payload size.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.316\", \"versionStartIncluding\": \"2.6.35\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.278\", \"versionStartIncluding\": \"2.6.35\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.219\", \"versionStartIncluding\": \"2.6.35\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.161\", \"versionStartIncluding\": \"2.6.35\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.93\", \"versionStartIncluding\": \"2.6.35\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.33\", \"versionStartIncluding\": \"2.6.35\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.12\", \"versionStartIncluding\": \"2.6.35\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.3\", \"versionStartIncluding\": \"2.6.35\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"2.6.35\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-04T09:24:38.139Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-36016\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-04T09:24:38.139Z\", \"dateReserved\": \"2024-05-17T13:50:33.154Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-29T18:46:34.778Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.