{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-38541", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-06-18T19:36:34.919Z", "datePublished": "2024-06-19T13:35:16.637Z", "dateUpdated": "2026-08-05T11:32:39.656Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:32:39.656Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nof: module: add buffer overflow check in of_modalias()\n\nIn of_modalias(), if the buffer happens to be too small even for the 1st\nsnprintf() call, the len parameter will become negative and str parameter\n(if not NULL initially) will point beyond the buffer's end. Add the buffer\noverflow check after the 1st snprintf() call and fix such check after the\nstrlen() call (accounting for the terminating NUL char)." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - `of_modalias()` is reached only through local syscalls — `read()` on the world-readable `uevent` (0644) or `modalias` (0444) sysfs attributes of any device-tree-backed device. No network protocol handler parses attacker data into this function.\nAC:L - The attacker simply reads a sysfs file; the code path is deterministic, repeatable, and involves no race, no memory-layout grooming, and no condition that must happen to occur at exploit time. Whether a qualifying DT node exists is a static property of the target platform, which CVSS treats as target configuration rather than attack complexity.\nPR:L - Any unprivileged local account can read `/sys/devices/.../uevent` and `/sys/devices/.../modalias`, which are mode 0644 and 0444 respectively — no capability, no user namespace, and no root is required.\nUI:N - The attacker triggers the code path entirely on their own by reading a sysfs attribute; no victim needs to mount a filesystem, plug in a device, or take any other action.\nS:U - The defect and its consequences are confined to the kernel's own address space and security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The write cursor is advanced past the end of the caller's buffer while the length accounting goes negative, and the loop guard omits the NUL terminator — out-of-bounds accounting adjacent to a heap-allocated `kobj_uevent_env` that is subsequently copied straight back to userspace, which can expose adjacent kernel heap contents.\nI:H - The commit adds an explicit buffer overflow check because `str` is left pointing beyond the buffer's end with a corrupted remaining-length value; out-of-bounds write accounting on a kernel heap buffer is scored High per out-of-bounds-write guidance.\nA:H - Corrupting memory past the end of a `kmalloc`'d uevent buffer can smash adjacent slab objects or redzones, producing a kernel oops or panic, and the path can be re-triggered arbitrarily often by an unprivileged reader." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/of/module.c" ], "versions": [ { "version": "bc575064d688c8933a6ca51429bea9bc63628d3b", "lessThan": "46795440ef2b4ac919d09310a69a404c5bc90a88", "status": "affected", "versionType": "git" }, { "version": "bc575064d688c8933a6ca51429bea9bc63628d3b", "lessThan": "733e62786bdf1b2b9dbb09ba2246313306503414", "status": "affected", "versionType": "git" }, { "version": "bc575064d688c8933a6ca51429bea9bc63628d3b", "lessThan": "c7f24b7d94549ff4623e8f41ea4d9f5319bd8ac8", "status": "affected", "versionType": "git" }, { "version": "bc575064d688c8933a6ca51429bea9bc63628d3b", "lessThan": "5d59fd637a8af42b211a92b2edb2474325b4d488", "status": "affected", "versionType": "git" }, { "version": "bc575064d688c8933a6ca51429bea9bc63628d3b", "lessThan": "0b0d5701a8bf02f8fee037e81aacf6746558bfd6", "status": "affected", "versionType": "git" }, { "version": "bc575064d688c8933a6ca51429bea9bc63628d3b", "lessThan": "ee332023adfd5882808f2dabf037b32d6ce36f9e", "status": "affected", "versionType": "git" }, { "version": "bc575064d688c8933a6ca51429bea9bc63628d3b", "lessThan": "e45b69360a63165377b30db4a1dfddd89ca18e9a", "status": "affected", "versionType": "git" }, { "version": "bc575064d688c8933a6ca51429bea9bc63628d3b", "lessThan": "cf7385cb26ac4f0ee6c7385960525ad534323252", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/of/module.c" ], "versions": [ { "version": "4.14", "status": "affected" }, { "version": "0", "lessThan": "4.14", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.294", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.238", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.182", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.136", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.33", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.8.12", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.9.3", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14", "versionEndExcluding": "5.4.294" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14", "versionEndExcluding": "5.10.238" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14", "versionEndExcluding": "5.15.182" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14", "versionEndExcluding": "6.1.136" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14", "versionEndExcluding": "6.6.33" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14", "versionEndExcluding": "6.8.12" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14", "versionEndExcluding": "6.9.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14", "versionEndExcluding": "6.10" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/46795440ef2b4ac919d09310a69a404c5bc90a88" }, { "url": "https://git.kernel.org/stable/c/733e62786bdf1b2b9dbb09ba2246313306503414" }, { "url": "https://git.kernel.org/stable/c/c7f24b7d94549ff4623e8f41ea4d9f5319bd8ac8" }, { "url": "https://git.kernel.org/stable/c/5d59fd637a8af42b211a92b2edb2474325b4d488" }, { "url": "https://git.kernel.org/stable/c/0b0d5701a8bf02f8fee037e81aacf6746558bfd6" }, { "url": "https://git.kernel.org/stable/c/ee332023adfd5882808f2dabf037b32d6ce36f9e" }, { "url": "https://git.kernel.org/stable/c/e45b69360a63165377b30db4a1dfddd89ca18e9a" }, { "url": "https://git.kernel.org/stable/c/cf7385cb26ac4f0ee6c7385960525ad534323252" } ], "title": "of: module: add buffer overflow check in of_modalias()", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "problemTypes": [ { "descriptions": [ { "type": "CWE", "cweId": "CWE-120", "lang": "en", "description": "CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')" } ] } ], "affected": [ { "vendor": "linux", "product": "linux_kernel", "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "versions": [ { "version": "bc575064d688", "status": "affected", "lessThan": "0b0d5701a8bf", "versionType": "custom" } ] }, { "vendor": "linux", "product": "linux_kernel", "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "versions": [ { "version": "bc575064d688", "status": "affected", "lessThan": "ee332023adfd", "versionType": "custom" } ] }, { "vendor": "linux", "product": "linux_kernel", "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "versions": [ { "version": "bc575064d688", "status": "affected", "lessThan": "e45b69360a63", "versionType": "custom" } ] }, { "vendor": "linux", "product": "linux_kernel", "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "versions": [ { "version": "bc575064d688", "status": "affected", "lessThan": "cf7385cb26ac", "versionType": "custom" } ] }, { "vendor": "linux", "product": "linux_kernel", "cpes": [ "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "versions": [ { "version": "4.14", "status": "affected" } ] }, { "vendor": "linux", "product": "linux_kernel", "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "versions": [ { "version": "0", "status": "unaffected", "lessThan": "4.14", "versionType": "custom" } ] }, { "vendor": "linux", "product": "linux_kernel", "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "versions": [ { "version": "6.6.33", "status": "unaffected", "lessThanOrEqual": "6.7", "versionType": "custom" } ] }, { "vendor": "linux", "product": "linux_kernel", "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "versions": [ { "version": "6.8.12", "status": "unaffected", "lessThanOrEqual": "6.9", "versionType": "custom" } ] }, { "vendor": "linux", "product": "linux_kernel", "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "versions": [ { "version": "6.9.3", "status": "unaffected", "lessThanOrEqual": "6.10", "versionType": "custom" } ] }, { "vendor": "linux", "product": "linux_kernel", "cpes": [ "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "versions": [ { "version": "6.10-rc1", "status": "unaffected" } ] } ], "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH" } }, { "other": { "type": "ssvc", "content": { "timestamp": "2025-05-07T19:51:57.578646Z", "id": "CVE-2024-38541", "options": [ { "Exploitation": "none" }, { "Automatable": "yes" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-04T13:56:15.426Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/0b0d5701a8bf02f8fee037e81aacf6746558bfd6", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/ee332023adfd5882808f2dabf037b32d6ce36f9e", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/e45b69360a63165377b30db4a1dfddd89ca18e9a", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/cf7385cb26ac4f0ee6c7385960525ad534323252", "tags": [ "x_transferred" ] }, { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:30:14.802Z" } } ] } }