PT-2024-3853 · Linux+4 · Linux Kernel+4

Mikko Rapeli · Published 2024-03-04 · Updated 2024-11-05 · CVE-2024-35785

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to incorrect error handling in the optee module of the Linux kernel, specifically when registering devices on the TEE bus. This can lead to a kernel panic. The error path has a bug that causes the kernel to panic when it fails to register devices. The commit that introduced this bug is mentioned as 7269cba53d90 ("tee: optee: Fix supplicant based device enumeration").

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

CWE-253

Related Identifiers

BDU:2024-04233

CVE-2024-35785

DLA-3842-1

OESA-2024-2292

OESA-2024-2293

USN-6898-1

USN-6898-2

USN-6898-3

USN-6898-4

USN-6917-1

USN-6919-1

USN-6927-1

USN-7019-1

Affected Products

Astra Linux

Linuxmint

Linux Kernel

Red Os

Ubuntu

References · 663

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/35xxx/CVE-2024-35785.json · Exploit
• https://ubuntu.com/security/CVE-2024-35984 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-40957 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-26999 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-52644 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-40984 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-26817 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-26601 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-26751 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-27398 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-42127 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-41002 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-26973 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-27044 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-35988 · Vendor Advisory