CVE-2024-35992

In the Linux kernel, the following vulnerability has been resolved: phy: marvell: a3700-comphy: Fix out of bounds read There is an out of bounds read access of 'gbe_phy_init_fix[fix_idx].addr' every iteration after 'fix_idx' reaches 'ARRAY_SIZE(gbe_phy_init_fix)'. Make sure 'gbe_phy_init[addr]' is used when all elements of 'gbe_phy_init_fix' array are handled. Found by Linux Verification Center (linuxtesting.org) with SVACE.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/40406dfbc060503d2e0a9e637e98493c54997b3d	Patch
https://git.kernel.org/stable/c/610f175d2e16fb2436ba7974b990563002c20d07	Patch
https://git.kernel.org/stable/c/976df695f579bbb2914114b4e9974fe4ed1eb813	Patch
https://git.kernel.org/stable/c/e4308bc22b9d46cf33165c9dfaeebcf29cd56f04	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

History

23 May 2024, 20:33

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.5
References	~~() https://git.kernel.org/stable/c/40406dfbc060503d2e0a9e637e98493c54997b3d -~~	() https://git.kernel.org/stable/c/40406dfbc060503d2e0a9e637e98493c54997b3d - Patch
References	~~() https://git.kernel.org/stable/c/610f175d2e16fb2436ba7974b990563002c20d07 -~~	() https://git.kernel.org/stable/c/610f175d2e16fb2436ba7974b990563002c20d07 - Patch
References	~~() https://git.kernel.org/stable/c/976df695f579bbb2914114b4e9974fe4ed1eb813 -~~	() https://git.kernel.org/stable/c/976df695f579bbb2914114b4e9974fe4ed1eb813 - Patch
References	~~() https://git.kernel.org/stable/c/e4308bc22b9d46cf33165c9dfaeebcf29cd56f04 -~~	() https://git.kernel.org/stable/c/e4308bc22b9d46cf33165c9dfaeebcf29cd56f04 - Patch
CPE		cpe:2.3:o:linux:linux_kernel::::::::
CWE		CWE-125
Summary		(es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: phy: marvell: a3700-comphy: corrección de lectura fuera de los límites. Hay un acceso de lectura fuera de los límites de 'gbe_phy_init_fix[fix_idx].addr' en cada iteración después de que 'fix_idx' alcance ' ARRAY_SIZE(gbe_phy_init_fix)'. Asegúrese de que se utilice 'gbe_phy_init[addr]' cuando se manejen todos los elementos de la matriz 'gbe_phy_init_fix'. Encontrado por el Centro de verificación de Linux (linuxtesting.org) con SVACE.
First Time		Linux linux Kernel Linux

20 May 2024, 10:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-05-20 10:15

Updated : 2024-05-23 20:33

NVD link : CVE-2024-35992

Mitre link : CVE-2024-35992

CVE.ORG link : CVE-2024-35992

JSON object : View

Products Affected

linux

linux_kernel

CWE

CWE-125

Out-of-bounds Read

5.5 /10