{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-57983", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-02-27T02:04:28.913Z", "datePublished": "2025-02-27T02:07:08.774Z", "dateUpdated": "2026-08-05T11:47:09.479Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:47:09.479Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: th1520: Fix memory corruption due to incorrect array size\n\nThe functions th1520_mbox_suspend_noirq and th1520_mbox_resume_noirq are\nintended to save and restore the interrupt mask registers in the MBOX\nICU0. However, the array used to store these registers was incorrectly\nsized, leading to memory corruption when accessing all four registers.\n\nThis commit corrects the array size to accommodate all four interrupt\nmask registers, preventing memory corruption during suspend and resume\noperations." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable code is a platform-driver system-sleep PM callback reached only through a local system suspend/hibernate transition; there is no network- or adjacent-network-facing path to it.\nAC:L - The overflow is unconditional — every suspend writes 4 bytes past the 12-byte allocation and every resume reads 4 bytes past it, with no race, timing window, or memory-layout condition outside the attacker's control, and it can be re-triggered on demand by repeating suspend cycles.\nPR:L - An unprivileged local user with an active session can initiate system suspend via logind/polkit (`org.freedesktop.login1.suspend` defaults to allow_active), and on autosleep-style embedded/Android deployments the cycle occurs with no privilege at all; real root in the init namespace is not required.\nUI:N - The attacker triggers the suspend/resume cycle themselves and the corruption occurs automatically in the PM callback; no action by any other user is needed.\nS:U - The out-of-bounds access corrupts kernel slab memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The resume path performs an out-of-bounds read of adjacent kernel heap memory, and the heap corruption from the paired OOB write is the class of defect that can be leveraged into a read primitive; per kernel scoring guidance heap memory corruption is treated as High confidentiality impact.\nI:H - This is an out-of-bounds heap write past a `devm_kzalloc` buffer, and out-of-bounds writes are scored High integrity because adjacent slab state can be modified and leveraged toward control-flow corruption.\nA:H - The slab out-of-bounds access oopses on KASAN/hardened kernels (panic with `panic_on_warn`) and heap corruption during the noirq suspend path can hang or crash the system, and it recurs on every suspend cycle." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/mailbox/mailbox-th1520.c" ], "versions": [ { "version": "5d4d263e1c6b6b18acb4d67fd3b9af71b7404924", "lessThan": "2cd12c7fba59f30369e8647a2b726c7280903304", "status": "affected", "versionType": "git" }, { "version": "5d4d263e1c6b6b18acb4d67fd3b9af71b7404924", "lessThan": "db049866943a38bf46a34fa120d526663339d7a5", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/mailbox/mailbox-th1520.c" ], "versions": [ { "version": "6.13", "status": "affected" }, { "version": "0", "lessThan": "6.13", "status": "unaffected", "versionType": "semver" }, { "version": "6.13.2", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.13.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.14" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/2cd12c7fba59f30369e8647a2b726c7280903304" }, { "url": "https://git.kernel.org/stable/c/db049866943a38bf46a34fa120d526663339d7a5" } ], "title": "mailbox: th1520: Fix memory corruption due to incorrect array size", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2024-57983", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "version": "2.0.3", "timestamp": "2025-10-01T19:31:43.584860Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T19:36:43.239Z" } } ] } }