{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-36965", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-30T15:25:07.081Z", "datePublished": "2024-06-08T12:52:58.404Z", "dateUpdated": "2026-08-05T11:32:20.070Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:32:20.070Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nremoteproc: mediatek: Make sure IPI buffer fits in L2TCM\n\nThe IPI buffer location is read from the firmware that we load to the\nSystem Companion Processor, and it's not granted that both the SRAM\n(L2TCM) size that is defined in the devicetree node is large enough\nfor that, and while this is especially true for multi-core SCP, it's\nstill useful to check on single-core variants as well.\n\nFailing to perform this check may make this driver perform R/W\noperations out of the L2TCM boundary, resulting (at best) in a\nkernel panic.\n\nTo fix that, check that the IPI buffer fits, otherwise return a\nfailure and refuse to boot the relevant SCP core (or the SCP at\nall, if this is single core)." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable path is reached by local means only — an unprivileged open() of /dev/video* (mtk-vcodec) or a write to /sys/class/remoteproc/*/state, with the firmware image read from the local filesystem. There is no network or remote-peer input involved.\nAC:L - The out-of-range `.ipi_buffer` sh_addr is a static, deterministic property of the loaded firmware image, so once the vulnerable configuration exists the OOB access happens 100% of the time; where the attacker supplies the image, the offset is directly and fully attacker-chosen. No race, no memory grooming, no unpredictable precondition.\nPR:L - An unprivileged local user with access to the V4L2 codec node (video group, standard on ChromeOS/Android MediaTek devices) triggers rproc_boot() → scp_parse_fw() → scp_ipi_init() by simply opening /dev/video0, and subsequently drives userspace-influenced data through the out-of-bounds send_buf via IPI. No capability or root is needed to reach the unvalidated code.\nUI:N - The attacker performs the triggering open()/ioctl sequence itself; no victim action is required, and on default configurations rproc->auto_boot even runs the path unattended at probe.\nS:U - The out-of-bounds reads and writes land in the kernel's own ioremap/vmalloc address space and are handled entirely by the kernel's security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - scp_ipi_handler() performs readl()/memcpy_fromio() from the out-of-bounds recv_buf and hands up to ~600 bytes of that out-of-range memory to registered IPI handlers, whose contents surface to userspace through vcodec/rpmsg — an unbounded kernel-address-space read primitive controlled by the offset.\nI:H - scp_ipi_init() memset_io()s past the L2TCM mapping, and scp_ipi_send() writes up to a full IPI payload of userspace-influenced bytes at sram_base+offset — an out-of-bounds write at an offset reachable across a 4GB range of the kernel's vmalloc/ioremap region, able to corrupt neighbouring MMIO registers, the other SCP core's L2TCM, or other vmalloc'd kernel objects.\nA:H - The commit message states the unchecked R/W past the L2TCM boundary results \"(at best) in a kernel panic\"; touching unmapped ioremap VA raises an unrecoverable data abort, and the resulting corruption can hang or crash the system, reproducible on every boot/open." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/remoteproc/mtk_scp.c" ], "versions": [ { "version": "3efa0ea743b77d1611501f7d8b4f320d032d73ae", "lessThan": "00548ac6b14428719c970ef90adae2b3b48c0cdf", "status": "affected", "versionType": "git" }, { "version": "3efa0ea743b77d1611501f7d8b4f320d032d73ae", "lessThan": "1d9e2de24533daca36cbf09e8d8596bf72b526b2", "status": "affected", "versionType": "git" }, { "version": "3efa0ea743b77d1611501f7d8b4f320d032d73ae", "lessThan": "26c6d7dc8c6a9fde9d362ab2eef6390efeff145e", "status": "affected", "versionType": "git" }, { "version": "3efa0ea743b77d1611501f7d8b4f320d032d73ae", "lessThan": "838b49e211d59fa827ff9df062d4020917cffbdf", "status": "affected", "versionType": "git" }, { "version": "3efa0ea743b77d1611501f7d8b4f320d032d73ae", "lessThan": "36c79eb4845551e9f6d28c663b38ce0ab03b84a9", "status": "affected", "versionType": "git" }, { "version": "3efa0ea743b77d1611501f7d8b4f320d032d73ae", "lessThan": "331f91d86f71d0bb89a44217cc0b2a22810bbd42", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/remoteproc/mtk_scp.c" ], "versions": [ { "version": "5.11", "status": "affected" }, { "version": "0", "lessThan": "5.11", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.160", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.92", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.32", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.8.11", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.9.2", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "5.15.160" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.1.92" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.6.32" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.8.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.9.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.10" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/00548ac6b14428719c970ef90adae2b3b48c0cdf" }, { "url": "https://git.kernel.org/stable/c/1d9e2de24533daca36cbf09e8d8596bf72b526b2" }, { "url": "https://git.kernel.org/stable/c/26c6d7dc8c6a9fde9d362ab2eef6390efeff145e" }, { "url": "https://git.kernel.org/stable/c/838b49e211d59fa827ff9df062d4020917cffbdf" }, { "url": "https://git.kernel.org/stable/c/36c79eb4845551e9f6d28c663b38ce0ab03b84a9" }, { "url": "https://git.kernel.org/stable/c/331f91d86f71d0bb89a44217cc0b2a22810bbd42" } ], "title": "remoteproc: mediatek: Make sure IPI buffer fits in L2TCM", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:43:50.595Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/00548ac6b14428719c970ef90adae2b3b48c0cdf", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/1d9e2de24533daca36cbf09e8d8596bf72b526b2", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/26c6d7dc8c6a9fde9d362ab2eef6390efeff145e", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/838b49e211d59fa827ff9df062d4020917cffbdf", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/36c79eb4845551e9f6d28c663b38ce0ab03b84a9", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/331f91d86f71d0bb89a44217cc0b2a22810bbd42", "tags": [ "x_transferred" ] } ] }, { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-36965", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T17:15:29.133298Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:58.958Z" } } ] } }