PT-2024-26831 · Linux+3 · Linux Kernel+3

Published 2024-04-06 · Updated 2024-08-13 · CVE-2024-35994

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to the QSEECOM APP SEND command, which expects both request and response buffers to be in a single memory region. Failure to adhere to this has resulted in either no response being written to the response buffer, the SCM call failing with EINVAL, or the device being hard-reset. This issue can be triggered deterministically but seems to happen rather sporadically. The problem is likely due to the two kzalloc() calls for request and response being directly after each other, which means they likely return consecutive regions most of the time. To fix this, a single memory region for both request and response buffers should be allocated, properly aligning both structs inside it. This also means that the qcom scm qseecom app send() interface needs to be restructured, as it should no longer map the DMA regions separately.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

BDU:2026-04265

CVE-2024-35994

USN-6949-1

USN-6949-2

USN-6952-1

USN-6952-2

USN-6955-1

Affected Products

Astra Linux

Linuxmint

Linux Kernel

Ubuntu

References · 260

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/35xxx/CVE-2024-35994.json · Exploit
• https://ubuntu.com/security/CVE-2024-35984 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6952-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36912 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36955 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-38568 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-27394 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36891 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36893 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36030 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-27398 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-38603 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6952-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-38544 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-39482 · Vendor Advisory