GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-38569 (GCVE-0-2024-38569)

Vulnerability from cvelistv5 – Published: 2024-06-19 13:35 – Updated: 2026-08-05 11:32
VLAI
Title
drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group
Summary
In the Linux kernel, the following vulnerability has been resolved: drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group The perf tool allows users to create event groups through following cmd [1], but the driver does not check whether the array index is out of bounds when writing data to the event_group array. If the number of events in an event_group is greater than HISI_PCIE_MAX_COUNTERS, the memory write overflow of event_group array occurs. Add array index check to fix the possible array out of bounds violation, and return directly when write new events are written to array bounds. There are 9 different events in an event_group. [1] perf stat -e '{pmu/event1/, ... ,pmu/event9/}'
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-24 18:24 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 8404b0fbc7fbd42e5c5d28cdedd450e70829c77a , < 3d1face00ebb7996842aee4214d7d0fb0c77b1e9 (git)
Affected: 8404b0fbc7fbd42e5c5d28cdedd450e70829c77a , < 8e9aab2492178f25372f1820bfd9289fbd74efd0 (git)
Affected: 8404b0fbc7fbd42e5c5d28cdedd450e70829c77a , < 567d34626c22b36579ec0abfdf5eda2949044220 (git)
Affected: 8404b0fbc7fbd42e5c5d28cdedd450e70829c77a , < ff48247144d13a3a0817127703724256008efa78 (git)
Affected: 8404b0fbc7fbd42e5c5d28cdedd450e70829c77a , < 77fce82678ea5fd51442e62febec2004f79e041b (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.17
Unaffected: 0 , < 5.17 (semver)
Unaffected: 6.1.93 , ≤ 6.1.* (semver)
Unaffected: 6.6.33 , ≤ 6.6.* (semver)
Unaffected: 6.8.12 , ≤ 6.8.* (semver)
Unaffected: 6.9.3 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38569",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-24T18:24:22.058209Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-24T18:24:28.077Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:12:26.114Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3d1face00ebb7996842aee4214d7d0fb0c77b1e9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8e9aab2492178f25372f1820bfd9289fbd74efd0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/567d34626c22b36579ec0abfdf5eda2949044220"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ff48247144d13a3a0817127703724256008efa78"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/77fce82678ea5fd51442e62febec2004f79e041b"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/perf/hisilicon/hisi_pcie_pmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3d1face00ebb7996842aee4214d7d0fb0c77b1e9",
              "status": "affected",
              "version": "8404b0fbc7fbd42e5c5d28cdedd450e70829c77a",
              "versionType": "git"
            },
            {
              "lessThan": "8e9aab2492178f25372f1820bfd9289fbd74efd0",
              "status": "affected",
              "version": "8404b0fbc7fbd42e5c5d28cdedd450e70829c77a",
              "versionType": "git"
            },
            {
              "lessThan": "567d34626c22b36579ec0abfdf5eda2949044220",
              "status": "affected",
              "version": "8404b0fbc7fbd42e5c5d28cdedd450e70829c77a",
              "versionType": "git"
            },
            {
              "lessThan": "ff48247144d13a3a0817127703724256008efa78",
              "status": "affected",
              "version": "8404b0fbc7fbd42e5c5d28cdedd450e70829c77a",
              "versionType": "git"
            },
            {
              "lessThan": "77fce82678ea5fd51442e62febec2004f79e041b",
              "status": "affected",
              "version": "8404b0fbc7fbd42e5c5d28cdedd450e70829c77a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/perf/hisilicon/hisi_pcie_pmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.93",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.33",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.12",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.3",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers/perf: hisi_pcie: Fix out-of-bound access when valid event group\n\nThe perf tool allows users to create event groups through following\ncmd [1], but the driver does not check whether the array index is out of\nbounds when writing data to the event_group array. If the number of events\nin an event_group is greater than HISI_PCIE_MAX_COUNTERS, the memory write\noverflow of event_group array occurs.\n\nAdd array index check to fix the possible array out of bounds violation,\nand return directly when write new events are written to array bounds.\n\nThere are 9 different events in an event_group.\n[1] perf stat -e \u0027{pmu/event1/, ... ,pmu/event9/}\u0027"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through the local `perf_event_open(2)` syscall against a HiSilicon PCIe PMU device; no network or remote-peer data is involved.\nAC:L - Triggering is fully deterministic \u2014 open a group leader plus 7 distinct hisi_pcie events, then open a 9th distinct event \u2014 with no race, timing window, or memory-layout condition outside the attacker\u0027s control.\nPR:L - On the profiling/HPC/Kunpeng-server deployments where this PMU driver is actually used, `kernel.perf_event_paranoid` is commonly set to 0 or -1, which makes `perf_allow_cpu()` pass for any unprivileged local user; only that (not real root) is needed to build the oversized event group.\nUI:N - The attacker performs the entire nine-syscall sequence itself; no victim action or cooperation is required.\nS:U - The out-of-bounds write corrupts the kernel\u0027s own stack within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The overflow is stack memory corruption adjacent to saved registers and spilled pointers, which per kernel scoring practice can be leveraged toward disclosure of kernel memory and defeats stack-layout confidentiality assumptions.\nI:H - This is an out-of-bounds stack write that places an attacker-groomed kernel heap pointer over the canary/saved-register slot above the array, i.e. corruption of control-flow-relevant stack state.\nA:H - On stack-protector-enabled arm64 builds the OOB write clobbers the canary and reliably triggers `__stack_chk_fail()` \u2192 kernel panic, and it can be repeated at will from userspace."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:32:50.420Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3d1face00ebb7996842aee4214d7d0fb0c77b1e9"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e9aab2492178f25372f1820bfd9289fbd74efd0"
        },
        {
          "url": "https://git.kernel.org/stable/c/567d34626c22b36579ec0abfdf5eda2949044220"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff48247144d13a3a0817127703724256008efa78"
        },
        {
          "url": "https://git.kernel.org/stable/c/77fce82678ea5fd51442e62febec2004f79e041b"
        }
      ],
      "title": "drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-38569",
    "datePublished": "2024-06-19T13:35:35.588Z",
    "dateReserved": "2024-06-18T19:36:34.923Z",
    "dateUpdated": "2026-08-05T11:32:50.420Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-38569",
      "date": "2026-09-18",
      "epss": "0.00234",
      "percentile": "0.14647"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/perf/hisilicon/hisi_pcie_pmu.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "3d1face00ebb7996842aee4214d7d0fb0c77b1e9",
                    "status": "affected",
                    "version": "8404b0fbc7fbd42e5c5d28cdedd450e70829c77a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8e9aab2492178f25372f1820bfd9289fbd74efd0",
                    "status": "affected",
                    "version": "8404b0fbc7fbd42e5c5d28cdedd450e70829c77a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "567d34626c22b36579ec0abfdf5eda2949044220",
                    "status": "affected",
                    "version": "8404b0fbc7fbd42e5c5d28cdedd450e70829c77a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ff48247144d13a3a0817127703724256008efa78",
                    "status": "affected",
                    "version": "8404b0fbc7fbd42e5c5d28cdedd450e70829c77a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "77fce82678ea5fd51442e62febec2004f79e041b",
                    "status": "affected",
                    "version": "8404b0fbc7fbd42e5c5d28cdedd450e70829c77a",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/perf/hisilicon/hisi_pcie_pmu.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.17"
                  },
                  {
                    "lessThan": "5.17",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.93",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.33",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.8.*",
                    "status": "unaffected",
                    "version": "6.8.12",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.9.*",
                    "status": "unaffected",
                    "version": "6.9.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.10",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "899D7A4F-A23D-4FA2-84B4-4BAA03F98BBC",
                    "versionEndExcluding": "6.1.93",
                    "versionStartIncluding": "5.17",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FCE796DF-3B50-4DC6-BAE5-95271068FC9E",
                    "versionEndExcluding": "6.6.33",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "80550309-67AB-4FD1-AC07-3DED5C4F01B2",
                    "versionEndExcluding": "6.8.12",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E07124C1-19E8-4D21-828D-9932A01D3011",
                    "versionEndExcluding": "6.9.3",
                    "versionStartIncluding": "6.9",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers/perf: hisi_pcie: Fix out-of-bound access when valid event group\n\nThe perf tool allows users to create event groups through following\ncmd [1], but the driver does not check whether the array index is out of\nbounds when writing data to the event_group array. If the number of events\nin an event_group is greater than HISI_PCIE_MAX_COUNTERS, the memory write\noverflow of event_group array occurs.\n\nAdd array index check to fix the possible array out of bounds violation,\nand return directly when write new events are written to array bounds.\n\nThere are 9 different events in an event_group.\n[1] perf stat -e \u0027{pmu/event1/, ... ,pmu/event9/}\u0027"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drivers/perf: hisi_pcie: corrige el acceso fuera de los l\u00edmites cuando el grupo de eventos es v\u00e1lido. La herramienta perf permite a los usuarios crear grupos de eventos mediante el siguiente cmd [1], pero el controlador no compruebe si el \u00edndice de la matriz est\u00e1 fuera de los l\u00edmites al escribir datos en la matriz event_group. Si el n\u00famero de eventos en un event_group es mayor que HISI_PCIE_MAX_COUNTERS, se produce un desbordamiento de escritura en la memoria de la matriz event_group. Agregue la verificaci\u00f3n del \u00edndice de la matriz para corregir la posible infracci\u00f3n de la matriz fuera de los l\u00edmites y regrese directamente cuando se escriban nuevos eventos en los l\u00edmites de la matriz. Hay 9 eventos diferentes en un grupo de eventos. [1] estad\u00edstica de rendimiento -e \u0027{pmu/event1/, ...,pmu/event9/}\u0027"
          }
        ],
        "id": "CVE-2024-38569",
        "lastModified": "2026-08-04T11:18:45.183",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-38569",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-24T18:24:22.058209Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-06-19T14:15:17.060",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3d1face00ebb7996842aee4214d7d0fb0c77b1e9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/567d34626c22b36579ec0abfdf5eda2949044220"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/77fce82678ea5fd51442e62febec2004f79e041b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8e9aab2492178f25372f1820bfd9289fbd74efd0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ff48247144d13a3a0817127703724256008efa78"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3d1face00ebb7996842aee4214d7d0fb0c77b1e9"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/567d34626c22b36579ec0abfdf5eda2949044220"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/77fce82678ea5fd51442e62febec2004f79e041b"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8e9aab2492178f25372f1820bfd9289fbd74efd0"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ff48247144d13a3a0817127703724256008efa78"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-129"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:45:29+00:00",
      "cve": "CVE-2024-38569",
      "id": "CVE-2024-38569",
      "initial_release_date": "2024-06-19T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-38569.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T04:12:26.114Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/3d1face00ebb7996842aee4214d7d0fb0c77b1e9"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/8e9aab2492178f25372f1820bfd9289fbd74efd0"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/567d34626c22b36579ec0abfdf5eda2949044220"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/ff48247144d13a3a0817127703724256008efa78"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/77fce82678ea5fd51442e62febec2004f79e041b"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-38569",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-06-24T18:24:22.058209Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-06-24T18:24:25.520Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/perf/hisilicon/hisi_pcie_pmu.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "3d1face00ebb7996842aee4214d7d0fb0c77b1e9",
                  "status": "affected",
                  "version": "8404b0fbc7fbd42e5c5d28cdedd450e70829c77a",
                  "versionType": "git"
                },
                {
                  "lessThan": "8e9aab2492178f25372f1820bfd9289fbd74efd0",
                  "status": "affected",
                  "version": "8404b0fbc7fbd42e5c5d28cdedd450e70829c77a",
                  "versionType": "git"
                },
                {
                  "lessThan": "567d34626c22b36579ec0abfdf5eda2949044220",
                  "status": "affected",
                  "version": "8404b0fbc7fbd42e5c5d28cdedd450e70829c77a",
                  "versionType": "git"
                },
                {
                  "lessThan": "ff48247144d13a3a0817127703724256008efa78",
                  "status": "affected",
                  "version": "8404b0fbc7fbd42e5c5d28cdedd450e70829c77a",
                  "versionType": "git"
                },
                {
                  "lessThan": "77fce82678ea5fd51442e62febec2004f79e041b",
                  "status": "affected",
                  "version": "8404b0fbc7fbd42e5c5d28cdedd450e70829c77a",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/perf/hisilicon/hisi_pcie_pmu.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.17"
                },
                {
                  "lessThan": "5.17",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.93",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.33",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.8.*",
                  "status": "unaffected",
                  "version": "6.8.12",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.9.*",
                  "status": "unaffected",
                  "version": "6.9.3",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.10",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.93",
                      "versionStartIncluding": "5.17",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.33",
                      "versionStartIncluding": "5.17",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.8.12",
                      "versionStartIncluding": "5.17",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.9.3",
                      "versionStartIncluding": "5.17",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.10",
                      "versionStartIncluding": "5.17",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers/perf: hisi_pcie: Fix out-of-bound access when valid event group\n\nThe perf tool allows users to create event groups through following\ncmd [1], but the driver does not check whether the array index is out of\nbounds when writing data to the event_group array. If the number of events\nin an event_group is greater than HISI_PCIE_MAX_COUNTERS, the memory write\noverflow of event_group array occurs.\n\nAdd array index check to fix the possible array out of bounds violation,\nand return directly when write new events are written to array bounds.\n\nThere are 9 different events in an event_group.\n[1] perf stat -e \u0027{pmu/event1/, ... ,pmu/event9/}\u0027"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The bug is reached only through the local `perf_event_open(2)` syscall against a HiSilicon PCIe PMU device; no network or remote-peer data is involved.\nAC:L - Triggering is fully deterministic \u2014 open a group leader plus 7 distinct hisi_pcie events, then open a 9th distinct event \u2014 with no race, timing window, or memory-layout condition outside the attacker\u0027s control.\nPR:L - On the profiling/HPC/Kunpeng-server deployments where this PMU driver is actually used, `kernel.perf_event_paranoid` is commonly set to 0 or -1, which makes `perf_allow_cpu()` pass for any unprivileged local user; only that (not real root) is needed to build the oversized event group.\nUI:N - The attacker performs the entire nine-syscall sequence itself; no victim action or cooperation is required.\nS:U - The out-of-bounds write corrupts the kernel\u0027s own stack within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The overflow is stack memory corruption adjacent to saved registers and spilled pointers, which per kernel scoring practice can be leveraged toward disclosure of kernel memory and defeats stack-layout confidentiality assumptions.\nI:H - This is an out-of-bounds stack write that places an attacker-groomed kernel heap pointer over the canary/saved-register slot above the array, i.e. corruption of control-flow-relevant stack state.\nA:H - On stack-protector-enabled arm64 builds the OOB write clobbers the canary and reliably triggers `__stack_chk_fail()` \u2192 kernel panic, and it can be repeated at will from userspace."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T11:32:50.420Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/3d1face00ebb7996842aee4214d7d0fb0c77b1e9"
            },
            {
              "url": "https://git.kernel.org/stable/c/8e9aab2492178f25372f1820bfd9289fbd74efd0"
            },
            {
              "url": "https://git.kernel.org/stable/c/567d34626c22b36579ec0abfdf5eda2949044220"
            },
            {
              "url": "https://git.kernel.org/stable/c/ff48247144d13a3a0817127703724256008efa78"
            },
            {
              "url": "https://git.kernel.org/stable/c/77fce82678ea5fd51442e62febec2004f79e041b"
            }
          ],
          "title": "drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-38569",
        "datePublished": "2024-06-19T13:35:35.588Z",
        "dateReserved": "2024-06-18T19:36:34.923Z",
        "dateUpdated": "2026-08-05T11:32:50.420Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.