01 Record

CVE-2024-35813

mmc: core: Avoid negative index with array access

HighPUBLISHEDCNA: Linux

CNA base score7.8 CVSS v3.xCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

mmc: core: Avoid negative index with array access

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.25% probability of exploitation activity in the next 30 days.

EPSS percentile

Ranks above 16.0% of scored records. A rank, not a probability.

NVD base score

5.5 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-08-04.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published: 2024-05-17 13:23Z2 YR AGO
Last updated: 2026-08-05 11:30Z1 MO AGO
Reserved: 2024-05-17
Assigning CNA: Linux
Record state: PUBLISHED
Severity: High (CVSS 7.8)
CNA CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses: No CWE assigned
Data version: 5.2
Document digest: 94283a561c37800fcfa27f3fd3a347b425d96f73e84407cfacabadefe4b4a247

05 Affected products

VendorProductVersionsPlatforms

LinuxLinuxf49f9e802785291149bdc9c824414de4604226b4 to < b9a7339ae403035ffe7fc37cb034b36947910f68, 59020bf0999ff7da8aedcd00ef8f0d75d93b6d20 to < 2b539c88940e22494da80a93ee1c5a28bbad10f6, 50b8b7a22e90bab9f1949b64a88ff17ab10913ec to < 81b8645feca08a54c7c4bf36e7b176f4983b2f28, c4edcd134bb72b3b0acc884612d624e48c9d057f to < ad9cc5e9e53ab94aa0c7ac65d43be7eb208dcb55, 1653a8102868264f3488c298a9f20af2add9a288 to < 4466677dcabe2d70de6aa3d4bd4a4fafa94a71f2, eed9119f8f8e8fbf225c08abdbb58597fba807e0 to < 064db53f9023a2d5877a2d12de6bc27995f6ca56, 4d0c8d0aef6355660b6775d57ccd5d4ea2e15802 to < 7d0e8a6147550aa058fa6ade8583ad252aa61304, 4d0c8d0aef6355660b6775d57ccd5d4ea2e15802 to < cf55a7acd1ed38afe43bba1c8a0935b51d1dc014, 5.4.269 to < 5.4.274, 5.10.210 to < 5.10.215, 5.15.149 to < 5.15.154, 6.1.76 to < 6.1.84, 6.6.15 to < 6.6.24, 6.7.3 to < 6.7.12, 6.8—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/b9a7339ae403035ffe7fc37cb034b36947910f68
git.kernel.orghttps://git.kernel.org/stable/c/2b539c88940e22494da80a93ee1c5a28bbad10f6
git.kernel.orghttps://git.kernel.org/stable/c/81b8645feca08a54c7c4bf36e7b176f4983b2f28
git.kernel.orghttps://git.kernel.org/stable/c/ad9cc5e9e53ab94aa0c7ac65d43be7eb208dcb55
git.kernel.orghttps://git.kernel.org/stable/c/4466677dcabe2d70de6aa3d4bd4a4fafa94a71f2
git.kernel.orghttps://git.kernel.org/stable/c/064db53f9023a2d5877a2d12de6bc27995f6ca56
git.kernel.orghttps://git.kernel.org/stable/c/7d0e8a6147550aa058fa6ade8583ad252aa61304
git.kernel.orghttps://git.kernel.org/stable/c/cf55a7acd1ed38afe43bba1c8a0935b51d1dc014
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-265688.html

01 Record index

CVE-2024-35813

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

02 Records

CVE-2024-35813

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References