CVE-2024-38606 (GCVE-0-2024-38606)
Vulnerability from cvelistv5
Published
2024-06-19 13:48
Modified
2026-08-05 11:33
Severity ?
7.1 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: crypto: qat - validate slices count returned by FW The function adf_send_admin_tl_start() enables the telemetry (TL) feature on a QAT device by sending the ICP_QAT_FW_TL_START message to the firmware. This triggers the FW to start writing TL data to a DMA buffer in memory and returns an array containing the number of accelerators of each type (slices) supported by this HW. The pointer to this array is stored in the adf_tl_hw_data data structure called slice_cnt. The array slice_cnt is then used in the function tl_print_dev_data() to report in debugfs only statistics about the supported accelerators. An incorrect value of the elements in slice_cnt might lead to an out of bounds memory read. At the moment, there isn't an implementation of FW that returns a wrong value, but for robustness validate the slice count array returned by FW.
References
Impacted products
Vendor Product Version
Linux Linux Version: 69e7649f7cc2aaa7889174456d39319a623c1a18
Version: 69e7649f7cc2aaa7889174456d39319a623c1a18
Version: 69e7649f7cc2aaa7889174456d39319a623c1a18
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38606",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-24T18:15:45.557603Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-24T18:15:53.748Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:12:25.956Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e57ed345e2e6043629fc74aa5be051415dcc4f77"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9b284b915e2a5e63ca133353f8c456eff4446f82"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/483fd65ce29317044d1d00757e3fd23503b6b04c"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/intel/qat/qat_common/adf_gen4_tl.c",
            "drivers/crypto/intel/qat/qat_common/adf_telemetry.c",
            "drivers/crypto/intel/qat/qat_common/adf_telemetry.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e57ed345e2e6043629fc74aa5be051415dcc4f77",
              "status": "affected",
              "version": "69e7649f7cc2aaa7889174456d39319a623c1a18",
              "versionType": "git"
            },
            {
              "lessThan": "9b284b915e2a5e63ca133353f8c456eff4446f82",
              "status": "affected",
              "version": "69e7649f7cc2aaa7889174456d39319a623c1a18",
              "versionType": "git"
            },
            {
              "lessThan": "483fd65ce29317044d1d00757e3fd23503b6b04c",
              "status": "affected",
              "version": "69e7649f7cc2aaa7889174456d39319a623c1a18",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/intel/qat/qat_common/adf_gen4_tl.c",
            "drivers/crypto/intel/qat/qat_common/adf_telemetry.c",
            "drivers/crypto/intel/qat/qat_common/adf_telemetry.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.12",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.3",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - validate slices count returned by FW\n\nThe function adf_send_admin_tl_start() enables the telemetry (TL)\nfeature on a QAT device by sending the ICP_QAT_FW_TL_START message to\nthe firmware. This triggers the FW to start writing TL data to a DMA\nbuffer in memory and returns an array containing the number of\naccelerators of each type (slices) supported by this HW.\nThe pointer to this array is stored in the adf_tl_hw_data data\nstructure called slice_cnt.\n\nThe array slice_cnt is then used in the function tl_print_dev_data()\nto report in debugfs only statistics about the supported accelerators.\nAn incorrect value of the elements in slice_cnt might lead to an out\nof bounds memory read.\nAt the moment, there isn\u0027t an implementation of FW that returns a wrong\nvalue, but for robustness validate the slice count array returned by FW."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The out-of-bounds read is triggered by a local read of the QAT telemetry debugfs file (/sys/kernel/debug/qat_*/telemetry/device_data), with the malicious slice counts supplied by the on-device firmware over the admin mailbox. There is no network or remote-peer path to this code.\nAC:L - No race, timing window, or memory-layout condition is involved \u2014 an oversized slice count deterministically drives the indexing loop past the end of the 2048-byte history buffer on every read of device_data. An attacker controlling the device firmware response reliably reproduces it.\nPR:L - Reaching the vulnerable print loop only requires read access to the telemetry debugfs node (mode 0444) once telemetry has been enabled, which is routine on monitored systems and on deployments that mount debugfs with relaxed permissions. No capability check exists anywhere on the path from tl_dev_data_show() to the OOB read.\nUI:N - The attacker performs the file read themselves; no victim action, mount, or interaction with a second user is needed.\nS:U - The overread stays within kernel memory managed by the same kernel security authority; the telemetry debugfs interface is PF-only so no VM, IOMMU, or sandbox boundary is crossed.\nC:H - With slice counts up to 255 instead of the 24-slice maximum, the read reaches offset ~3664 in a 2048-byte kmalloc\u0027d buffer \u2014 about 1.6 KB of adjacent slab memory \u2014 and those bytes are printed to userspace as counter values, giving a repeatable kernel heap disclosure primitive.\nI:N - The firmware-supplied count is used solely as a loop bound and read offset; no kernel memory is written, freed, or otherwise modified through this path.\nA:H - The unbounded slice index walks off the end of the slab object, which can fault or trip KASAN/KFENCE guard pages when the buffer sits at the tail of a slab, oopsing the kernel; the read is repeatable on every access to device_data."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:33:06.514Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e57ed345e2e6043629fc74aa5be051415dcc4f77"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b284b915e2a5e63ca133353f8c456eff4446f82"
        },
        {
          "url": "https://git.kernel.org/stable/c/483fd65ce29317044d1d00757e3fd23503b6b04c"
        }
      ],
      "title": "crypto: qat - validate slices count returned by FW",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-38606",
    "datePublished": "2024-06-19T13:48:16.428Z",
    "dateReserved": "2024-06-18T19:36:34.935Z",
    "dateUpdated": "2026-08-05T11:33:06.514Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e57ed345e2e6043629fc74aa5be051415dcc4f77\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/9b284b915e2a5e63ca133353f8c456eff4446f82\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/483fd65ce29317044d1d00757e3fd23503b6b04c\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:12:25.956Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-38606\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-24T18:15:45.557603Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-24T18:15:50.545Z\"}}], \"cna\": {\"title\": \"crypto: qat - validate slices count returned by FW\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"69e7649f7cc2aaa7889174456d39319a623c1a18\", \"lessThan\": \"e57ed345e2e6043629fc74aa5be051415dcc4f77\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"69e7649f7cc2aaa7889174456d39319a623c1a18\", \"lessThan\": \"9b284b915e2a5e63ca133353f8c456eff4446f82\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"69e7649f7cc2aaa7889174456d39319a623c1a18\", \"lessThan\": \"483fd65ce29317044d1d00757e3fd23503b6b04c\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/crypto/intel/qat/qat_common/adf_gen4_tl.c\", \"drivers/crypto/intel/qat/qat_common/adf_telemetry.c\", \"drivers/crypto/intel/qat/qat_common/adf_telemetry.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.8.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/crypto/intel/qat/qat_common/adf_gen4_tl.c\", \"drivers/crypto/intel/qat/qat_common/adf_telemetry.c\", \"drivers/crypto/intel/qat/qat_common/adf_telemetry.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e57ed345e2e6043629fc74aa5be051415dcc4f77\"}, {\"url\": \"https://git.kernel.org/stable/c/9b284b915e2a5e63ca133353f8c456eff4446f82\"}, {\"url\": \"https://git.kernel.org/stable/c/483fd65ce29317044d1d00757e3fd23503b6b04c\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncrypto: qat - validate slices count returned by FW\\n\\nThe function adf_send_admin_tl_start() enables the telemetry (TL)\\nfeature on a QAT device by sending the ICP_QAT_FW_TL_START message to\\nthe firmware. This triggers the FW to start writing TL data to a DMA\\nbuffer in memory and returns an array containing the number of\\naccelerators of each type (slices) supported by this HW.\\nThe pointer to this array is stored in the adf_tl_hw_data data\\nstructure called slice_cnt.\\n\\nThe array slice_cnt is then used in the function tl_print_dev_data()\\nto report in debugfs only statistics about the supported accelerators.\\nAn incorrect value of the elements in slice_cnt might lead to an out\\nof bounds memory read.\\nAt the moment, there isn\u0027t an implementation of FW that returns a wrong\\nvalue, but for robustness validate the slice count array returned by FW.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.12\", \"versionStartIncluding\": \"6.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.3\", \"versionStartIncluding\": \"6.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"6.8\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:19:58.675Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-38606\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:19:58.675Z\", \"dateReserved\": \"2024-06-18T19:36:34.935Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-06-19T13:48:16.428Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.