{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-38635", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-06-18T19:36:34.947Z", "datePublished": "2024-06-21T10:18:24.244Z", "dateUpdated": "2026-08-05T11:33:17.807Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:33:17.807Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoundwire: cadence: fix invalid PDI offset\n\nFor some reason, we add an offset to the PDI, presumably to skip the\nPDI0 and PDI1 which are reserved for BPT.\n\nThis code is however completely wrong and leads to an out-of-bounds\naccess. We were just lucky so far since we used only a couple of PDIs\nand remained within the PDI array bounds.\n\nA Fixes: tag is not provided since there are no known platforms where\nthe out-of-bounds would be accessed, and the initial code had problems\nas well.\n\nA follow-up patch completely removes this useless offset." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable code is reached only through the ALSA PCM device node (`/dev/snd/pcmC*D*`) via `SNDRV_PCM_IOCTL_HW_PARAMS`, which funnels into the ASoC DAI `.hw_params` callback `intel_hw_params()` and then `sdw_cdns_alloc_pdi()`. This requires local access to the machine; there is no network or adjacent-network path to a SoundWire manager DAI.\nAC:L - The out-of-bounds walk is unconditional arithmetic (`i = 2; i < 2 + num_bd`) with no race, no timing window, and no dependency on memory layout to occur — an attacker simply configures hw_params on a bidirectional-PDI DAI and the read past the array happens deterministically. Heap grooming to make the adjacent slab object's first word match the small `dai_id` value, and thus convert the read into the OOB write, is standard and repeatable since the attacker can retry the ioctl arbitrarily many times.\nPR:L - The attacker needs no capabilities, only the ability to open a PCM device — granted to ordinary desktop users via the `audio` group or logind seat ACLs, and to ordinary apps in Android's audio domain. No CAP_SYS_ADMIN, CAP_SYS_RAWIO, or root check exists anywhere on the path from the ioctl to `cdns_find_pdi()`.\nUI:N - The attacker performs the entire sequence itself — open the PCM device and issue HW_PARAMS with a chosen channel count — with no victim action, no filesystem mount, and no file opened by another user.\nS:U - The out-of-bounds read and write both occur in kernel heap memory within the same kernel security authority; nothing crosses a VM, IOMMU, or sandbox boundary.\nC:H - The loop reads `pdi[num_bd].num` and `pdi[num_bd+1].num` from beyond the `devm_kcalloc()` allocation, and the resulting out-of-bounds pointer is stored in `dai_runtime->pdi` and used to source values (`num`, `intel_alh_id`, `ch_count`) that are programmed into SHIM/ALH/Cadence registers, leaking adjacent kernel heap contents; per kernel guidance, heap memory corruption of this kind is leverageable for information disclosure.\nI:H - When the out-of-bounds `num` matches `dai_id`, `sdw_cdns_alloc_pdi()` writes five fields (`l_ch_num`, `h_ch_num`, `ch_count`, `dir`, and later `intel_alh_id`) through the out-of-bounds pointer, corrupting roughly 20 bytes of the neighbouring slab object with values partly controlled by the attacker-supplied channel count. A heap out-of-bounds write with attacker-influenced data is a classic primitive for control-flow hijack via heap grooming.\nA:H - The out-of-bounds access trips KASAN/hardened-usercopy checks and, on production kernels, corrupts adjacent slab metadata or a neighbouring object, readily producing an oops or panic; the stale out-of-bounds `dai_runtime->pdi` pointer is re-dereferenced in `.prepare`, `.trigger`, and `.hw_free`, compounding the crash potential." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/soundwire/cadence_master.c" ], "versions": [ { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "002364b2d594a9afc0385c09e00994c510b1d089", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "fd4bcb991ebaf0d1813d81d9983cfa99f9ef5328", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "902f6d656441a511ac25c6cffce74496db10a078", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "2ebcaa0e5db9b6044bb487ae1cf41bc601761567", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "7eeef1e935d23db5265233d92395bd5c648a4021", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "4e99103f757cdf636c6ee860994a19a346a11785", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "8ee1b439b1540ae543149b15a2a61b9dff937d91", "status": "affected", "versionType": "git" }, { "version": "0", "lessThan": "5.4.278", "status": "affected", "versionType": "semver" }, { "version": "0", "lessThan": "5.10.219", "status": "affected", "versionType": "semver" }, { "version": "0", "lessThan": "5.15.161", "status": "affected", "versionType": "semver" }, { "version": "0", "lessThan": "6.1.93", "status": "affected", "versionType": "semver" }, { "version": "0", "lessThan": "6.6.33", "status": "affected", "versionType": "semver" }, { "version": "0", "lessThan": "6.9.4", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/soundwire/cadence_master.c" ], "versions": [ { "version": "5.4.278", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.219", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.161", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.93", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.33", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.9.4", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "5.4.278" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "5.10.219" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "5.15.161" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.1.93" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.6.33" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.9.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.10" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/002364b2d594a9afc0385c09e00994c510b1d089" }, { "url": "https://git.kernel.org/stable/c/fd4bcb991ebaf0d1813d81d9983cfa99f9ef5328" }, { "url": "https://git.kernel.org/stable/c/902f6d656441a511ac25c6cffce74496db10a078" }, { "url": "https://git.kernel.org/stable/c/2ebcaa0e5db9b6044bb487ae1cf41bc601761567" }, { "url": "https://git.kernel.org/stable/c/7eeef1e935d23db5265233d92395bd5c648a4021" }, { "url": "https://git.kernel.org/stable/c/4e99103f757cdf636c6ee860994a19a346a11785" }, { "url": "https://git.kernel.org/stable/c/8ee1b439b1540ae543149b15a2a61b9dff937d91" } ], "title": "soundwire: cadence: fix invalid PDI offset", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2024-06-21T13:12:09.388099Z", "id": "CVE-2024-38635", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-21T13:12:24.572Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:12:26.040Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/002364b2d594a9afc0385c09e00994c510b1d089", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/fd4bcb991ebaf0d1813d81d9983cfa99f9ef5328", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/902f6d656441a511ac25c6cffce74496db10a078", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/2ebcaa0e5db9b6044bb487ae1cf41bc601761567", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/7eeef1e935d23db5265233d92395bd5c648a4021", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/4e99103f757cdf636c6ee860994a19a346a11785", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/8ee1b439b1540ae543149b15a2a61b9dff937d91", "tags": [ "x_transferred" ] } ] }, { "x_adpType": "supplier", "providerMetadata": { "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-05-12T11:55:13.405Z" }, "affected": [ { "vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [ { "status": "affected", "version": "0", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" } ], "references": [ { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ] } ] } }