CVE-2024-36965 (GCVE-0-2024-36965)

Vulnerability from cvelistv5 – Published: 2024-06-08 12:52 – Updated: 2026-08-05 11:32
VLAI
Title
remoteproc: mediatek: Make sure IPI buffer fits in L2TCM
Summary
In the Linux kernel, the following vulnerability has been resolved: remoteproc: mediatek: Make sure IPI buffer fits in L2TCM The IPI buffer location is read from the firmware that we load to the System Companion Processor, and it's not granted that both the SRAM (L2TCM) size that is defined in the devicetree node is large enough for that, and while this is especially true for multi-core SCP, it's still useful to check on single-core variants as well. Failing to perform this check may make this driver perform R/W operations out of the L2TCM boundary, resulting (at best) in a kernel panic. To fix that, check that the IPI buffer fits, otherwise return a failure and refuse to boot the relevant SCP core (or the SCP at all, if this is single core).
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 3efa0ea743b77d1611501f7d8b4f320d032d73ae , < 00548ac6b14428719c970ef90adae2b3b48c0cdf (git)
Affected: 3efa0ea743b77d1611501f7d8b4f320d032d73ae , < 1d9e2de24533daca36cbf09e8d8596bf72b526b2 (git)
Affected: 3efa0ea743b77d1611501f7d8b4f320d032d73ae , < 26c6d7dc8c6a9fde9d362ab2eef6390efeff145e (git)
Affected: 3efa0ea743b77d1611501f7d8b4f320d032d73ae , < 838b49e211d59fa827ff9df062d4020917cffbdf (git)
Affected: 3efa0ea743b77d1611501f7d8b4f320d032d73ae , < 36c79eb4845551e9f6d28c663b38ce0ab03b84a9 (git)
Affected: 3efa0ea743b77d1611501f7d8b4f320d032d73ae , < 331f91d86f71d0bb89a44217cc0b2a22810bbd42 (git)
Create a notification for this product.
Linux Linux Affected: 5.11
Unaffected: 0 , < 5.11 (semver)
Unaffected: 5.15.160 , ≤ 5.15.* (semver)
Unaffected: 6.1.92 , ≤ 6.1.* (semver)
Unaffected: 6.6.32 , ≤ 6.6.* (semver)
Unaffected: 6.8.11 , ≤ 6.8.* (semver)
Unaffected: 6.9.2 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:43:50.595Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/00548ac6b14428719c970ef90adae2b3b48c0cdf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1d9e2de24533daca36cbf09e8d8596bf72b526b2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/26c6d7dc8c6a9fde9d362ab2eef6390efeff145e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/838b49e211d59fa827ff9df062d4020917cffbdf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/36c79eb4845551e9f6d28c663b38ce0ab03b84a9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/331f91d86f71d0bb89a44217cc0b2a22810bbd42"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-36965",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:15:29.133298Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:58.958Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/remoteproc/mtk_scp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "00548ac6b14428719c970ef90adae2b3b48c0cdf",
              "status": "affected",
              "version": "3efa0ea743b77d1611501f7d8b4f320d032d73ae",
              "versionType": "git"
            },
            {
              "lessThan": "1d9e2de24533daca36cbf09e8d8596bf72b526b2",
              "status": "affected",
              "version": "3efa0ea743b77d1611501f7d8b4f320d032d73ae",
              "versionType": "git"
            },
            {
              "lessThan": "26c6d7dc8c6a9fde9d362ab2eef6390efeff145e",
              "status": "affected",
              "version": "3efa0ea743b77d1611501f7d8b4f320d032d73ae",
              "versionType": "git"
            },
            {
              "lessThan": "838b49e211d59fa827ff9df062d4020917cffbdf",
              "status": "affected",
              "version": "3efa0ea743b77d1611501f7d8b4f320d032d73ae",
              "versionType": "git"
            },
            {
              "lessThan": "36c79eb4845551e9f6d28c663b38ce0ab03b84a9",
              "status": "affected",
              "version": "3efa0ea743b77d1611501f7d8b4f320d032d73ae",
              "versionType": "git"
            },
            {
              "lessThan": "331f91d86f71d0bb89a44217cc0b2a22810bbd42",
              "status": "affected",
              "version": "3efa0ea743b77d1611501f7d8b4f320d032d73ae",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/remoteproc/mtk_scp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.32",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.160",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.92",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.32",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.11",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.2",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nremoteproc: mediatek: Make sure IPI buffer fits in L2TCM\n\nThe IPI buffer location is read from the firmware that we load to the\nSystem Companion Processor, and it\u0027s not granted that both the SRAM\n(L2TCM) size that is defined in the devicetree node is large enough\nfor that, and while this is especially true for multi-core SCP, it\u0027s\nstill useful to check on single-core variants as well.\n\nFailing to perform this check may make this driver perform R/W\noperations out of the L2TCM boundary, resulting (at best) in a\nkernel panic.\n\nTo fix that, check that the IPI buffer fits, otherwise return a\nfailure and refuse to boot the relevant SCP core (or the SCP at\nall, if this is single core)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached by local means only \u2014 an unprivileged open() of /dev/video* (mtk-vcodec) or a write to /sys/class/remoteproc/*/state, with the firmware image read from the local filesystem. There is no network or remote-peer input involved.\nAC:L - The out-of-range `.ipi_buffer` sh_addr is a static, deterministic property of the loaded firmware image, so once the vulnerable configuration exists the OOB access happens 100% of the time; where the attacker supplies the image, the offset is directly and fully attacker-chosen. No race, no memory grooming, no unpredictable precondition.\nPR:L - An unprivileged local user with access to the V4L2 codec node (video group, standard on ChromeOS/Android MediaTek devices) triggers rproc_boot() \u2192 scp_parse_fw() \u2192 scp_ipi_init() by simply opening /dev/video0, and subsequently drives userspace-influenced data through the out-of-bounds send_buf via IPI. No capability or root is needed to reach the unvalidated code.\nUI:N - The attacker performs the triggering open()/ioctl sequence itself; no victim action is required, and on default configurations rproc-\u003eauto_boot even runs the path unattended at probe.\nS:U - The out-of-bounds reads and writes land in the kernel\u0027s own ioremap/vmalloc address space and are handled entirely by the kernel\u0027s security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - scp_ipi_handler() performs readl()/memcpy_fromio() from the out-of-bounds recv_buf and hands up to ~600 bytes of that out-of-range memory to registered IPI handlers, whose contents surface to userspace through vcodec/rpmsg \u2014 an unbounded kernel-address-space read primitive controlled by the offset.\nI:H - scp_ipi_init() memset_io()s past the L2TCM mapping, and scp_ipi_send() writes up to a full IPI payload of userspace-influenced bytes at sram_base+offset \u2014 an out-of-bounds write at an offset reachable across a 4GB range of the kernel\u0027s vmalloc/ioremap region, able to corrupt neighbouring MMIO registers, the other SCP core\u0027s L2TCM, or other vmalloc\u0027d kernel objects.\nA:H - The commit message states the unchecked R/W past the L2TCM boundary results \"(at best) in a kernel panic\"; touching unmapped ioremap VA raises an unrecoverable data abort, and the resulting corruption can hang or crash the system, reproducible on every boot/open."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:32:20.070Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/00548ac6b14428719c970ef90adae2b3b48c0cdf"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d9e2de24533daca36cbf09e8d8596bf72b526b2"
        },
        {
          "url": "https://git.kernel.org/stable/c/26c6d7dc8c6a9fde9d362ab2eef6390efeff145e"
        },
        {
          "url": "https://git.kernel.org/stable/c/838b49e211d59fa827ff9df062d4020917cffbdf"
        },
        {
          "url": "https://git.kernel.org/stable/c/36c79eb4845551e9f6d28c663b38ce0ab03b84a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/331f91d86f71d0bb89a44217cc0b2a22810bbd42"
        }
      ],
      "title": "remoteproc: mediatek: Make sure IPI buffer fits in L2TCM",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-36965",
    "datePublished": "2024-06-08T12:52:58.404Z",
    "dateReserved": "2024-05-30T15:25:07.081Z",
    "dateUpdated": "2026-08-05T11:32:20.070Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-36965",
      "date": "2026-08-07",
      "epss": "0.00221",
      "percentile": "0.12654"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T02:24:49.000Z",
      "cve": "CVE-2024-36965",
      "id": "msrc_CVE-2024-36965",
      "initial_release_date": "2024-06-02T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "remoteproc: mediatek: Make sure IPI buffer fits in L2TCM",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-36965.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-36965\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-06-08T13:15:57.820\",\"lastModified\":\"2026-06-17T07:37:28.267\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nremoteproc: mediatek: Make sure IPI buffer fits in L2TCM\\n\\nThe IPI buffer location is read from the firmware that we load to the\\nSystem Companion Processor, and it\u0027s not granted that both the SRAM\\n(L2TCM) size that is defined in the devicetree node is large enough\\nfor that, and while this is especially true for multi-core SCP, it\u0027s\\nstill useful to check on single-core variants as well.\\n\\nFailing to perform this check may make this driver perform R/W\\noperations out of the L2TCM boundary, resulting (at best) in a\\nkernel panic.\\n\\nTo fix that, check that the IPI buffer fits, otherwise return a\\nfailure and refuse to boot the relevant SCP core (or the SCP at\\nall, if this is single core).\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: remoteproc: mediatek: aseg\u00farese de que el b\u00fafer IPI encaje en L2TCM. La ubicaci\u00f3n del b\u00fafer IPI se lee desde el firmware que cargamos en el procesador System Companion, y no se garantiza que tanto la SRAM ( L2TCM) que se define en el nodo del \u00e1rbol de dispositivos es lo suficientemente grande para eso, y si bien esto es especialmente cierto para SCP de m\u00faltiples n\u00facleos, tambi\u00e9n es \u00fatil verificar las variantes de un solo n\u00facleo. No realizar esta verificaci\u00f3n puede hacer que este controlador realice operaciones de lectura y escritura fuera del l\u00edmite L2TCM, lo que resultar\u00e1 (en el mejor de los casos) en un p\u00e1nico en el kernel. Para solucionarlo, verifique que el b\u00fafer IPI encaje; de lo contrario, devolver\u00e1 una falla y se negar\u00e1 a iniciar el n\u00facleo SCP relevante (o el SCP en absoluto, si es de un solo n\u00facleo).\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/remoteproc/mtk_scp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3efa0ea743b77d1611501f7d8b4f320d032d73ae\",\"lessThan\":\"00548ac6b14428719c970ef90adae2b3b48c0cdf\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3efa0ea743b77d1611501f7d8b4f320d032d73ae\",\"lessThan\":\"1d9e2de24533daca36cbf09e8d8596bf72b526b2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3efa0ea743b77d1611501f7d8b4f320d032d73ae\",\"lessThan\":\"26c6d7dc8c6a9fde9d362ab2eef6390efeff145e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3efa0ea743b77d1611501f7d8b4f320d032d73ae\",\"lessThan\":\"838b49e211d59fa827ff9df062d4020917cffbdf\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3efa0ea743b77d1611501f7d8b4f320d032d73ae\",\"lessThan\":\"36c79eb4845551e9f6d28c663b38ce0ab03b84a9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3efa0ea743b77d1611501f7d8b4f320d032d73ae\",\"lessThan\":\"331f91d86f71d0bb89a44217cc0b2a22810bbd42\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/remoteproc/mtk_scp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.160\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.92\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.32\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.11\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.2\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T17:15:29.133298Z\",\"id\":\"CVE-2024-36965\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndIncluding\":\"5.15.160\",\"matchCriteriaId\":\"EB1227F5-B622-45F2-80C8-F94E3F45859D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndIncluding\":\"6.1.92\",\"matchCriteriaId\":\"D7E75569-629C-4E66-840F-75A9E1A870CB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndIncluding\":\"6.6.32\",\"matchCriteriaId\":\"9E9EFAF5-AF5B-459D-B215-645B1CE4A579\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndIncluding\":\"6.8.11\",\"matchCriteriaId\":\"73BBA055-7988-4EAB-8218-196DA874ED2A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.9\",\"versionEndIncluding\":\"6.9.2\",\"matchCriteriaId\":\"6539B4CE-9805-42AB-AEAF-91ED579F0F01\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/00548ac6b14428719c970ef90adae2b3b48c0cdf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1d9e2de24533daca36cbf09e8d8596bf72b526b2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/26c6d7dc8c6a9fde9d362ab2eef6390efeff145e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/331f91d86f71d0bb89a44217cc0b2a22810bbd42\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/36c79eb4845551e9f6d28c663b38ce0ab03b84a9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/838b49e211d59fa827ff9df062d4020917cffbdf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/00548ac6b14428719c970ef90adae2b3b48c0cdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1d9e2de24533daca36cbf09e8d8596bf72b526b2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/26c6d7dc8c6a9fde9d362ab2eef6390efeff145e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/331f91d86f71d0bb89a44217cc0b2a22810bbd42\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/36c79eb4845551e9f6d28c663b38ce0ab03b84a9\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/838b49e211d59fa827ff9df062d4020917cffbdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:53:16+00:00",
      "cve": "CVE-2024-36965",
      "id": "CVE-2024-36965",
      "initial_release_date": "2024-06-08T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: remoteproc: mediatek: Make sure IPI buffer fits in L2TCM",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-36965.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/00548ac6b14428719c970ef90adae2b3b48c0cdf\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/1d9e2de24533daca36cbf09e8d8596bf72b526b2\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/26c6d7dc8c6a9fde9d362ab2eef6390efeff145e\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/838b49e211d59fa827ff9df062d4020917cffbdf\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/36c79eb4845551e9f6d28c663b38ce0ab03b84a9\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/331f91d86f71d0bb89a44217cc0b2a22810bbd42\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:43:50.595Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-36965\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:15:29.133298Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:27.300Z\"}}], \"cna\": {\"title\": \"remoteproc: mediatek: Make sure IPI buffer fits in L2TCM\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3efa0ea743b77d1611501f7d8b4f320d032d73ae\", \"lessThan\": \"00548ac6b14428719c970ef90adae2b3b48c0cdf\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3efa0ea743b77d1611501f7d8b4f320d032d73ae\", \"lessThan\": \"1d9e2de24533daca36cbf09e8d8596bf72b526b2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3efa0ea743b77d1611501f7d8b4f320d032d73ae\", \"lessThan\": \"26c6d7dc8c6a9fde9d362ab2eef6390efeff145e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3efa0ea743b77d1611501f7d8b4f320d032d73ae\", \"lessThan\": \"838b49e211d59fa827ff9df062d4020917cffbdf\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3efa0ea743b77d1611501f7d8b4f320d032d73ae\", \"lessThan\": \"36c79eb4845551e9f6d28c663b38ce0ab03b84a9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3efa0ea743b77d1611501f7d8b4f320d032d73ae\", \"lessThan\": \"331f91d86f71d0bb89a44217cc0b2a22810bbd42\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/remoteproc/mtk_scp.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.11\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.11\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.160\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.92\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.32\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.11\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/remoteproc/mtk_scp.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/00548ac6b14428719c970ef90adae2b3b48c0cdf\"}, {\"url\": \"https://git.kernel.org/stable/c/1d9e2de24533daca36cbf09e8d8596bf72b526b2\"}, {\"url\": \"https://git.kernel.org/stable/c/26c6d7dc8c6a9fde9d362ab2eef6390efeff145e\"}, {\"url\": \"https://git.kernel.org/stable/c/838b49e211d59fa827ff9df062d4020917cffbdf\"}, {\"url\": \"https://git.kernel.org/stable/c/36c79eb4845551e9f6d28c663b38ce0ab03b84a9\"}, {\"url\": \"https://git.kernel.org/stable/c/331f91d86f71d0bb89a44217cc0b2a22810bbd42\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nremoteproc: mediatek: Make sure IPI buffer fits in L2TCM\\n\\nThe IPI buffer location is read from the firmware that we load to the\\nSystem Companion Processor, and it\u0027s not granted that both the SRAM\\n(L2TCM) size that is defined in the devicetree node is large enough\\nfor that, and while this is especially true for multi-core SCP, it\u0027s\\nstill useful to check on single-core variants as well.\\n\\nFailing to perform this check may make this driver perform R/W\\noperations out of the L2TCM boundary, resulting (at best) in a\\nkernel panic.\\n\\nTo fix that, check that the IPI buffer fits, otherwise return a\\nfailure and refuse to boot the relevant SCP core (or the SCP at\\nall, if this is single core).\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.160\", \"versionStartIncluding\": \"5.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.92\", \"versionStartIncluding\": \"5.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.32\", \"versionStartIncluding\": \"5.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.11\", \"versionStartIncluding\": \"5.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.2\", \"versionStartIncluding\": \"5.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"5.11\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:18:01.034Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-36965\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:18:01.034Z\", \"dateReserved\": \"2024-05-30T15:25:07.081Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-06-08T12:52:58.404Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.