CVE-2024-41028 (GCVE-0-2024-41028)
Vulnerability from cvelistv5
Published
2024-07-29 14:31
Modified
2026-08-05 11:34
Severity ?
7.1 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: platform/x86: toshiba_acpi: Fix array out-of-bounds access In order to use toshiba_dmi_quirks[] together with the standard DMI matching functions, it must be terminated by a empty entry. Since this entry is missing, an array out-of-bounds access occurs every time the quirk list is processed. Fix this by adding the terminating empty entry.
References
Impacted products
Vendor Product Version
Linux Linux Version: 3cb1f40dfdc3b9f5449076c96b4e2523139f5cd0
Version: 3cb1f40dfdc3b9f5449076c96b4e2523139f5cd0
Version: 3cb1f40dfdc3b9f5449076c96b4e2523139f5cd0
Version: 3cb1f40dfdc3b9f5449076c96b4e2523139f5cd0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:59:27.844Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e030aa6c972641cb069086a8c7a0f747653e472a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/639868f1cb87b683cf830353bbee0c4078202313"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0d71da43d6b7916d36cf1953d793da80433c50bf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b6e02c6b0377d4339986e07aeb696c632cd392aa"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-41028",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:24:02.601705Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:04.253Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/platform/x86/toshiba_acpi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e030aa6c972641cb069086a8c7a0f747653e472a",
              "status": "affected",
              "version": "3cb1f40dfdc3b9f5449076c96b4e2523139f5cd0",
              "versionType": "git"
            },
            {
              "lessThan": "639868f1cb87b683cf830353bbee0c4078202313",
              "status": "affected",
              "version": "3cb1f40dfdc3b9f5449076c96b4e2523139f5cd0",
              "versionType": "git"
            },
            {
              "lessThan": "0d71da43d6b7916d36cf1953d793da80433c50bf",
              "status": "affected",
              "version": "3cb1f40dfdc3b9f5449076c96b4e2523139f5cd0",
              "versionType": "git"
            },
            {
              "lessThan": "b6e02c6b0377d4339986e07aeb696c632cd392aa",
              "status": "affected",
              "version": "3cb1f40dfdc3b9f5449076c96b4e2523139f5cd0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/platform/x86/toshiba_acpi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "lessThan": "6.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.100",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.41",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.100",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.41",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.10",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: toshiba_acpi: Fix array out-of-bounds access\n\nIn order to use toshiba_dmi_quirks[] together with the standard DMI\nmatching functions, it must be terminated by a empty entry.\n\nSince this entry is missing, an array out-of-bounds access occurs\nevery time the quirk list is processed.\n\nFix this by adding the terminating empty entry."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The out-of-bounds access occurs in the driver\u0027s `__init` path (`toshiba_acpi_init()` \u2192 `toshiba_dmi_init()`), reached only via local module load or in-kernel boot-time initialization. There is no network- or adjacent-network-reachable path to this code.\nAC:L - The commit states the out-of-bounds access \"occurs every time the quirk list is processed\" \u2014 it is fully deterministic and requires no race, timing, or special state, and `toshiba_dmi_init()` runs unconditionally before any hardware check, so it triggers on any x86 system.\nPR:L - On builds with `CONFIG_ACPI_TOSHIBA=y` the faulty code executes automatically at boot, and on modular builds it runs on driver load, exposing every local user on the system without requiring real root privileges in the initial namespace. Consistent with CVE-2025-38661, the identical missing-`dmi_system_id`-terminator bug class.\nUI:N - The out-of-bounds walk happens automatically during module/kernel initialization; no victim action such as opening a file or mounting a filesystem is needed.\nS:U - The corruption and its effects are confined to the kernel\u0027s own memory and the toshiba_acpi driver\u0027s quirk flags, with no crossing of a virtualization, IOMMU, or sandbox boundary.\nC:H - The unterminated table causes reads far past the array into `.init.rodata`, and the resulting garbage `slot` values (0\u2013127 from the 7-bit bitfield) index past the 23-entry `dmi_ident[]` into adjacent globals such as `dmi_devices`, whose contents are then dereferenced by `strstr()`/`strcmp()` \u2014 an unbounded read of arbitrary kernel memory, not a strictly bounded few-byte overread.\nI:N - `dmi_first_match()` and `dmi_matches()` only read; the only downstream effect is setting the `turn_on_panel_on_resume` and `hci_hotkey_quickstart` boolean quirk flags, so no attacker-controlled memory write or control-flow hijack primitive is produced.\nA:H - The wild-pointer dereference in `strstr()`/`strcmp()` on an out-of-bounds `dmi_ident[]` entry, plus `strcmp()` against a possibly non-NUL-terminated inline garbage buffer, can fault and oops the kernel during boot or module initialization, and the unterminated loop may run for an unbounded number of iterations."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:34:49.614Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e030aa6c972641cb069086a8c7a0f747653e472a"
        },
        {
          "url": "https://git.kernel.org/stable/c/639868f1cb87b683cf830353bbee0c4078202313"
        },
        {
          "url": "https://git.kernel.org/stable/c/0d71da43d6b7916d36cf1953d793da80433c50bf"
        },
        {
          "url": "https://git.kernel.org/stable/c/b6e02c6b0377d4339986e07aeb696c632cd392aa"
        }
      ],
      "title": "platform/x86: toshiba_acpi: Fix array out-of-bounds access",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-41028",
    "datePublished": "2024-07-29T14:31:44.704Z",
    "dateReserved": "2024-07-12T12:17:45.617Z",
    "dateUpdated": "2026-08-05T11:34:49.614Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e030aa6c972641cb069086a8c7a0f747653e472a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/639868f1cb87b683cf830353bbee0c4078202313\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0d71da43d6b7916d36cf1953d793da80433c50bf\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/b6e02c6b0377d4339986e07aeb696c632cd392aa\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:39:56.186Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-41028\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:24:02.601705Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:20.478Z\"}}], \"cna\": {\"title\": \"platform/x86: toshiba_acpi: Fix array out-of-bounds access\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3cb1f40dfdc3b9f5449076c96b4e2523139f5cd0\", \"lessThan\": \"e030aa6c972641cb069086a8c7a0f747653e472a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3cb1f40dfdc3b9f5449076c96b4e2523139f5cd0\", \"lessThan\": \"639868f1cb87b683cf830353bbee0c4078202313\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3cb1f40dfdc3b9f5449076c96b4e2523139f5cd0\", \"lessThan\": \"0d71da43d6b7916d36cf1953d793da80433c50bf\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3cb1f40dfdc3b9f5449076c96b4e2523139f5cd0\", \"lessThan\": \"b6e02c6b0377d4339986e07aeb696c632cd392aa\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/platform/x86/toshiba_acpi.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.1\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.1\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.100\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.41\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/platform/x86/toshiba_acpi.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e030aa6c972641cb069086a8c7a0f747653e472a\"}, {\"url\": \"https://git.kernel.org/stable/c/639868f1cb87b683cf830353bbee0c4078202313\"}, {\"url\": \"https://git.kernel.org/stable/c/0d71da43d6b7916d36cf1953d793da80433c50bf\"}, {\"url\": \"https://git.kernel.org/stable/c/b6e02c6b0377d4339986e07aeb696c632cd392aa\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nplatform/x86: toshiba_acpi: Fix array out-of-bounds access\\n\\nIn order to use toshiba_dmi_quirks[] together with the standard DMI\\nmatching functions, it must be terminated by a empty entry.\\n\\nSince this entry is missing, an array out-of-bounds access occurs\\nevery time the quirk list is processed.\\n\\nFix this by adding the terminating empty entry.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.100\", \"versionStartIncluding\": \"6.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.41\", \"versionStartIncluding\": \"6.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.10\", \"versionStartIncluding\": \"6.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"6.1\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:20:25.698Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-41028\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T09:20:25.698Z\", \"dateReserved\": \"2024-07-12T12:17:45.617Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-29T14:31:44.704Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.