CVE-2024-35994 (GCVE-0-2024-35994)

Vulnerability from cvelistv5 – Published: 2024-05-20 09:47 – Updated: 2026-08-05 11:31
VLAI
Title
firmware: qcom: uefisecapp: Fix memory related IO errors and crashes
Summary
In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: uefisecapp: Fix memory related IO errors and crashes It turns out that while the QSEECOM APP_SEND command has specific fields for request and response buffers, uefisecapp expects them both to be in a single memory region. Failure to adhere to this has (so far) resulted in either no response being written to the response buffer (causing an EIO to be emitted down the line), the SCM call to fail with EINVAL (i.e., directly from TZ/firmware), or the device to be hard-reset. While this issue can be triggered deterministically, in the current form it seems to happen rather sporadically (which is why it has gone unnoticed during earlier testing). This is likely due to the two kzalloc() calls (for request and response) being directly after each other. Which means that those likely return consecutive regions most of the time, especially when not much else is going on in the system. Fix this by allocating a single memory region for both request and response buffers, properly aligning both structs inside it. This unfortunately also means that the qcom_scm_qseecom_app_send() interface needs to be restructured, as it should no longer map the DMA regions separately. Therefore, move the responsibility of DMA allocation (or mapping) to the caller.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 759e7a2b62eb3ef3c93ffeb5cca788a09627d7d9 , < dd22b34fb53cb04b13b2f5eee5c9200bb091fc88 (git)
Affected: 759e7a2b62eb3ef3c93ffeb5cca788a09627d7d9 , < ed09f81eeaa8f9265e1787282cb283f10285c259 (git)
Create a notification for this product.
Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 6.8.9 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35994",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-20T14:05:44.255812Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:33:52.169Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:30:11.569Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/dd22b34fb53cb04b13b2f5eee5c9200bb091fc88"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ed09f81eeaa8f9265e1787282cb283f10285c259"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/firmware/qcom/qcom_qseecom_uefisecapp.c",
            "drivers/firmware/qcom/qcom_scm.c",
            "include/linux/firmware/qcom/qcom_qseecom.h",
            "include/linux/firmware/qcom/qcom_scm.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dd22b34fb53cb04b13b2f5eee5c9200bb091fc88",
              "status": "affected",
              "version": "759e7a2b62eb3ef3c93ffeb5cca788a09627d7d9",
              "versionType": "git"
            },
            {
              "lessThan": "ed09f81eeaa8f9265e1787282cb283f10285c259",
              "status": "affected",
              "version": "759e7a2b62eb3ef3c93ffeb5cca788a09627d7d9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/firmware/qcom/qcom_qseecom_uefisecapp.c",
            "drivers/firmware/qcom/qcom_scm.c",
            "include/linux/firmware/qcom/qcom_qseecom.h",
            "include/linux/firmware/qcom/qcom_scm.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.9",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: qcom: uefisecapp: Fix memory related IO errors and crashes\n\nIt turns out that while the QSEECOM APP_SEND command has specific fields\nfor request and response buffers, uefisecapp expects them both to be in\na single memory region. Failure to adhere to this has (so far) resulted\nin either no response being written to the response buffer (causing an\nEIO to be emitted down the line), the SCM call to fail with EINVAL\n(i.e., directly from TZ/firmware), or the device to be hard-reset.\n\nWhile this issue can be triggered deterministically, in the current form\nit seems to happen rather sporadically (which is why it has gone\nunnoticed during earlier testing). This is likely due to the two\nkzalloc() calls (for request and response) being directly after each\nother. Which means that those likely return consecutive regions most of\nthe time, especially when not much else is going on in the system.\n\nFix this by allocating a single memory region for both request and\nresponse buffers, properly aligning both structs inside it. This\nunfortunately also means that the qcom_scm_qseecom_app_send() interface\nneeds to be restructured, as it should no longer map the DMA regions\nseparately. Therefore, move the responsibility of DMA allocation (or\nmapping) to the caller."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached through the local efivarfs filesystem (`read()` on /sys/firmware/efi/efivars/*), which drives the qcuefi efivar operations; there is no network or remote path to uefisecapp.\nAC:L - The commit states the issue \"can be triggered deterministically\" \u2014 it merely looks sporadic because idle-system slab behaviour happens to place the two kzalloc()s adjacently, and an attacker fully controls slab layout via concurrent allocation pressure, parallel readers, and choice of which variable (hence which kmalloc bucket) to read.\nPR:L - efivarfs contains no capable()/CAP_* checks whatsoever and creates variable files mode 0644 under a 0755 directory, so any local unprivileged user can read an EFI variable and drive the buggy request/response allocation pair twice per read().\nUI:N - The attacker triggers the path entirely from their own process by reading efivarfs files; no action by any other user or administrator is needed.\nS:U - The corruption and the reset both land on the same device under the kernel\u0027s own security authority; although the secure world is involved, this is scored as standard kernel-local impact rather than a VM/IOMMU boundary escape.\nC:H - When the buffers are non-contiguous the secure world reads and writes normal-world memory outside the regions the kernel allocated and mapped for it, giving out-of-bounds access to adjacent kernel slab objects that can be groomed and leveraged for kernel memory disclosure.\nI:H - The documented failure mode where \"no response [is] written to the response buffer\" means uefisecapp wrote the response into kernel memory outside the allocated response buffer \u2014 an out-of-bounds write by a higher-privileged agent into an attacker-groomable slab neighbour, which is exploitable for kernel memory corruption.\nA:H - The commit explicitly documents that the mismatch can cause \"the device to be hard-reset\", a full SoC reset, and the SCM/EIO failures also render the EFI variable interface unusable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:31:28.204Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dd22b34fb53cb04b13b2f5eee5c9200bb091fc88"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed09f81eeaa8f9265e1787282cb283f10285c259"
        }
      ],
      "title": "firmware: qcom: uefisecapp: Fix memory related IO errors and crashes",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35994",
    "datePublished": "2024-05-20T09:47:58.396Z",
    "dateReserved": "2024-05-17T13:50:33.147Z",
    "dateUpdated": "2026-08-05T11:31:28.204Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-35994",
      "date": "2026-08-04",
      "epss": "0.00183",
      "percentile": "0.0807"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-35994\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-20T10:15:13.530\",\"lastModified\":\"2026-06-17T07:35:54.273\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfirmware: qcom: uefisecapp: Fix memory related IO errors and crashes\\n\\nIt turns out that while the QSEECOM APP_SEND command has specific fields\\nfor request and response buffers, uefisecapp expects them both to be in\\na single memory region. Failure to adhere to this has (so far) resulted\\nin either no response being written to the response buffer (causing an\\nEIO to be emitted down the line), the SCM call to fail with EINVAL\\n(i.e., directly from TZ/firmware), or the device to be hard-reset.\\n\\nWhile this issue can be triggered deterministically, in the current form\\nit seems to happen rather sporadically (which is why it has gone\\nunnoticed during earlier testing). This is likely due to the two\\nkzalloc() calls (for request and response) being directly after each\\nother. Which means that those likely return consecutive regions most of\\nthe time, especially when not much else is going on in the system.\\n\\nFix this by allocating a single memory region for both request and\\nresponse buffers, properly aligning both structs inside it. This\\nunfortunately also means that the qcom_scm_qseecom_app_send() interface\\nneeds to be restructured, as it should no longer map the DMA regions\\nseparately. Therefore, move the responsibility of DMA allocation (or\\nmapping) to the caller.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: firmware: qcom: uefisecapp: corrige errores y bloqueos de E/S relacionados con la memoria. Resulta que, si bien el comando QSEECOM APP_SEND tiene campos espec\u00edficos para los buffers de solicitud y respuesta, uefisecapp espera que ambos est\u00e9n en una \u00fanica regi\u00f3n de memoria. El incumplimiento de esto ha dado como resultado (hasta ahora) que no se escriba ninguna respuesta en el b\u00fafer de respuesta (lo que provoca que se emita un EIO en el futuro), que la llamada SCM falle con EINVAL (es decir, directamente desde TZ/firmware), o el dispositivo para ser reiniciado. Si bien este problema puede desencadenarse de manera determinista, en la forma actual parece ocurrir de manera bastante espor\u00e1dica (raz\u00f3n por la cual pas\u00f3 desapercibido durante las pruebas anteriores). Es probable que esto se deba a que las dos llamadas a kzalloc() (para solicitud y respuesta) est\u00e1n directamente una detr\u00e1s de la otra. Lo que significa que es probable que regresen a regiones consecutivas la mayor parte del tiempo, especialmente cuando no sucede mucho m\u00e1s en el sistema. Solucione este problema asignando una \u00fanica regi\u00f3n de memoria para los b\u00faferes de solicitud y respuesta, alineando adecuadamente ambas estructuras dentro de ella. Lamentablemente, esto tambi\u00e9n significa que la interfaz qcom_scm_qseecom_app_send() debe reestructurarse, ya que ya no deber\u00eda asignar las regiones DMA por separado. Por lo tanto, traslade la responsabilidad de la asignaci\u00f3n (o mapeo) de DMA a la persona que llama.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/firmware/qcom/qcom_qseecom_uefisecapp.c\",\"drivers/firmware/qcom/qcom_scm.c\",\"include/linux/firmware/qcom/qcom_qseecom.h\",\"include/linux/firmware/qcom/qcom_scm.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"759e7a2b62eb3ef3c93ffeb5cca788a09627d7d9\",\"lessThan\":\"dd22b34fb53cb04b13b2f5eee5c9200bb091fc88\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"759e7a2b62eb3ef3c93ffeb5cca788a09627d7d9\",\"lessThan\":\"ed09f81eeaa8f9265e1787282cb283f10285c259\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/firmware/qcom/qcom_qseecom_uefisecapp.c\",\"drivers/firmware/qcom/qcom_scm.c\",\"include/linux/firmware/qcom/qcom_qseecom.h\",\"include/linux/firmware/qcom/qcom_scm.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.9\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-05-20T14:05:44.255812Z\",\"id\":\"CVE-2024-35994\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-401\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.9\",\"matchCriteriaId\":\"5F9041E5-8358-4EF7-8F98-B812EDE49612\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"52048DDA-FC5A-4363-95A0-A6357B4D7F8C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A06B2CCF-3F43-4FA9-8773-C83C3F5764B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"F850DCEC-E08B-4317-A33B-D2DCF39F601B\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/dd22b34fb53cb04b13b2f5eee5c9200bb091fc88\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ed09f81eeaa8f9265e1787282cb283f10285c259\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dd22b34fb53cb04b13b2f5eee5c9200bb091fc88\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ed09f81eeaa8f9265e1787282cb283f10285c259\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:53:40+00:00",
      "cve": "CVE-2024-35994",
      "id": "CVE-2024-35994",
      "initial_release_date": "2024-05-20T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: firmware: qcom: uefisecapp: Fix memory related IO errors and crashes",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-35994.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/dd22b34fb53cb04b13b2f5eee5c9200bb091fc88\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/ed09f81eeaa8f9265e1787282cb283f10285c259\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:30:11.569Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-35994\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-20T14:05:44.255812Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:24.744Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"firmware: qcom: uefisecapp: Fix memory related IO errors and crashes\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable code is reached through the local efivarfs filesystem (`read()` on /sys/firmware/efi/efivars/*), which drives the qcuefi efivar operations; there is no network or remote path to uefisecapp.\\nAC:L - The commit states the issue \\\"can be triggered deterministically\\\" \\u2014 it merely looks sporadic because idle-system slab behaviour happens to place the two kzalloc()s adjacently, and an attacker fully controls slab layout via concurrent allocation pressure, parallel readers, and choice of which variable (hence which kmalloc bucket) to read.\\nPR:L - efivarfs contains no capable()/CAP_* checks whatsoever and creates variable files mode 0644 under a 0755 directory, so any local unprivileged user can read an EFI variable and drive the buggy request/response allocation pair twice per read().\\nUI:N - The attacker triggers the path entirely from their own process by reading efivarfs files; no action by any other user or administrator is needed.\\nS:U - The corruption and the reset both land on the same device under the kernel\u0027s own security authority; although the secure world is involved, this is scored as standard kernel-local impact rather than a VM/IOMMU boundary escape.\\nC:H - When the buffers are non-contiguous the secure world reads and writes normal-world memory outside the regions the kernel allocated and mapped for it, giving out-of-bounds access to adjacent kernel slab objects that can be groomed and leveraged for kernel memory disclosure.\\nI:H - The documented failure mode where \\\"no response [is] written to the response buffer\\\" means uefisecapp wrote the response into kernel memory outside the allocated response buffer \\u2014 an out-of-bounds write by a higher-privileged agent into an attacker-groomable slab neighbour, which is exploitable for kernel memory corruption.\\nA:H - The commit explicitly documents that the mismatch can cause \\\"the device to be hard-reset\\\", a full SoC reset, and the SCM/EIO failures also render the EFI variable interface unusable.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"759e7a2b62eb3ef3c93ffeb5cca788a09627d7d9\", \"lessThan\": \"dd22b34fb53cb04b13b2f5eee5c9200bb091fc88\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"759e7a2b62eb3ef3c93ffeb5cca788a09627d7d9\", \"lessThan\": \"ed09f81eeaa8f9265e1787282cb283f10285c259\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/firmware/qcom/qcom_qseecom_uefisecapp.c\", \"drivers/firmware/qcom/qcom_scm.c\", \"include/linux/firmware/qcom/qcom_qseecom.h\", \"include/linux/firmware/qcom/qcom_scm.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.8.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/firmware/qcom/qcom_qseecom_uefisecapp.c\", \"drivers/firmware/qcom/qcom_scm.c\", \"include/linux/firmware/qcom/qcom_qseecom.h\", \"include/linux/firmware/qcom/qcom_scm.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/dd22b34fb53cb04b13b2f5eee5c9200bb091fc88\"}, {\"url\": \"https://git.kernel.org/stable/c/ed09f81eeaa8f9265e1787282cb283f10285c259\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfirmware: qcom: uefisecapp: Fix memory related IO errors and crashes\\n\\nIt turns out that while the QSEECOM APP_SEND command has specific fields\\nfor request and response buffers, uefisecapp expects them both to be in\\na single memory region. Failure to adhere to this has (so far) resulted\\nin either no response being written to the response buffer (causing an\\nEIO to be emitted down the line), the SCM call to fail with EINVAL\\n(i.e., directly from TZ/firmware), or the device to be hard-reset.\\n\\nWhile this issue can be triggered deterministically, in the current form\\nit seems to happen rather sporadically (which is why it has gone\\nunnoticed during earlier testing). This is likely due to the two\\nkzalloc() calls (for request and response) being directly after each\\nother. Which means that those likely return consecutive regions most of\\nthe time, especially when not much else is going on in the system.\\n\\nFix this by allocating a single memory region for both request and\\nresponse buffers, properly aligning both structs inside it. This\\nunfortunately also means that the qcom_scm_qseecom_app_send() interface\\nneeds to be restructured, as it should no longer map the DMA regions\\nseparately. Therefore, move the responsibility of DMA allocation (or\\nmapping) to the caller.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.9\", \"versionStartIncluding\": \"6.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"6.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:31:28.204Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-35994\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:31:28.204Z\", \"dateReserved\": \"2024-05-17T13:50:33.147Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-20T09:47:58.396Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.