PT-2024-26829 · Linux+6 · Linux Kernel+6
Mikhail Kobuk
·
Published
2024-03-21
·
Updated
2025-09-29
·
CVE-2024-35992
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.37
Description
The issue is related to an out of bounds read access of
gbe phy init fix[fix idx].addr every iteration after fix idx reaches ARRAY SIZE(gbe phy init fix). To fix this, gbe phy init[addr] should be used when all elements of gbe phy init fix array are handled. This was found by Linux Verification Center with SVACE.Recommendations
Update to Linux kernel version 6.6.37 or later to resolve the issue.
As a temporary workaround, consider restricting access to the vulnerable
gbe phy init fix array until a patch is available.Exploit
Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu