GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-56662 (GCVE-0-2024-56662)

Vulnerability from cvelistv5 – Published: 2024-12-27 15:06 – Updated: 2026-08-05 11:45
VLAI
Title
acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl
Summary
In the Linux kernel, the following vulnerability has been resolved: acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl Fix an issue detected by syzbot with KASAN: BUG: KASAN: vmalloc-out-of-bounds in cmd_to_func drivers/acpi/nfit/ core.c:416 [inline] BUG: KASAN: vmalloc-out-of-bounds in acpi_nfit_ctl+0x20e8/0x24a0 drivers/acpi/nfit/core.c:459 The issue occurs in cmd_to_func when the call_pkg->nd_reserved2 array is accessed without verifying that call_pkg points to a buffer that is appropriately sized as a struct nd_cmd_pkg. This can lead to out-of-bounds access and undefined behavior if the buffer does not have sufficient space. To address this, a check was added in acpi_nfit_ctl() to ensure that buf is not NULL and that buf_len is less than sizeof(*call_pkg) before accessing it. This ensures safe access to the members of call_pkg, including the nd_reserved2 array.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
6 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 19:59 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ebe9f6f19d80d8978d16078dff3d5bd93ad8d102 , < 616aa5f3c86e0479bcbb81e41c08c43ff32af637 (git)
Affected: ebe9f6f19d80d8978d16078dff3d5bd93ad8d102 , < bbdb3307f609ec4dc9558770f464ede01fe52aed (git)
Affected: ebe9f6f19d80d8978d16078dff3d5bd93ad8d102 , < 143f723e9eb4f0302ffb7adfdc7ef77eab3f68e0 (git)
Affected: ebe9f6f19d80d8978d16078dff3d5bd93ad8d102 , < e08dc2dc3c3f7938df0e4476fe3e6fdec5583c1d (git)
Affected: ebe9f6f19d80d8978d16078dff3d5bd93ad8d102 , < 212846fafb753a48e869e2a342fc1e24048da771 (git)
Affected: ebe9f6f19d80d8978d16078dff3d5bd93ad8d102 , < 265e98f72bac6c41a4492d3e30a8e5fd22fe0779 (git)
Affected: 63108f2a408abea7ecab063efa0f398da4d0d14b (git)
Affected: f5878c4f084dc6b1386dad03970bb61ad5e9dc4b (git)
Affected: 0c79794474895dbbc3c52225f7e9f73cfecbb7dd (git)
Affected: 4.14.176 , < 4.15 (semver)
Affected: 4.19.31 , < 4.20 (semver)
Affected: 5.0.4 , < 5.1 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.1
Unaffected: 0 , < 5.1 (semver)
Unaffected: 5.10.232 , ≤ 5.10.* (semver)
Unaffected: 5.15.175 , ≤ 5.15.* (semver)
Unaffected: 6.1.121 , ≤ 6.1.* (semver)
Unaffected: 6.6.67 , ≤ 6.6.* (semver)
Unaffected: 6.12.6 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-56662",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:59:57.981489Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "CWE-125 Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:07:10.083Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:52:10.200Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/acpi/nfit/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "616aa5f3c86e0479bcbb81e41c08c43ff32af637",
              "status": "affected",
              "version": "ebe9f6f19d80d8978d16078dff3d5bd93ad8d102",
              "versionType": "git"
            },
            {
              "lessThan": "bbdb3307f609ec4dc9558770f464ede01fe52aed",
              "status": "affected",
              "version": "ebe9f6f19d80d8978d16078dff3d5bd93ad8d102",
              "versionType": "git"
            },
            {
              "lessThan": "143f723e9eb4f0302ffb7adfdc7ef77eab3f68e0",
              "status": "affected",
              "version": "ebe9f6f19d80d8978d16078dff3d5bd93ad8d102",
              "versionType": "git"
            },
            {
              "lessThan": "e08dc2dc3c3f7938df0e4476fe3e6fdec5583c1d",
              "status": "affected",
              "version": "ebe9f6f19d80d8978d16078dff3d5bd93ad8d102",
              "versionType": "git"
            },
            {
              "lessThan": "212846fafb753a48e869e2a342fc1e24048da771",
              "status": "affected",
              "version": "ebe9f6f19d80d8978d16078dff3d5bd93ad8d102",
              "versionType": "git"
            },
            {
              "lessThan": "265e98f72bac6c41a4492d3e30a8e5fd22fe0779",
              "status": "affected",
              "version": "ebe9f6f19d80d8978d16078dff3d5bd93ad8d102",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "63108f2a408abea7ecab063efa0f398da4d0d14b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f5878c4f084dc6b1386dad03970bb61ad5e9dc4b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0c79794474895dbbc3c52225f7e9f73cfecbb7dd",
              "versionType": "git"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.176",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.31",
              "versionType": "semver"
            },
            {
              "lessThan": "5.1",
              "status": "affected",
              "version": "5.0.4",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/acpi/nfit/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.1"
            },
            {
              "lessThan": "5.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.232",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.121",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.67",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.232",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.175",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.121",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.67",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.6",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.176",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.0.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nacpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl\n\nFix an issue detected by syzbot with KASAN:\n\nBUG: KASAN: vmalloc-out-of-bounds in cmd_to_func drivers/acpi/nfit/\ncore.c:416 [inline]\nBUG: KASAN: vmalloc-out-of-bounds in acpi_nfit_ctl+0x20e8/0x24a0\ndrivers/acpi/nfit/core.c:459\n\nThe issue occurs in cmd_to_func when the call_pkg-\u003end_reserved2\narray is accessed without verifying that call_pkg points to a buffer\nthat is appropriately sized as a struct nd_cmd_pkg. This can lead\nto out-of-bounds access and undefined behavior if the buffer does not\nhave sufficient space.\n\nTo address this, a check was added in acpi_nfit_ctl() to ensure that\nbuf is not NULL and that buf_len is less than sizeof(*call_pkg)\nbefore accessing it. This ensures safe access to the members of\ncall_pkg, including the nd_reserved2 array."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached exclusively through the `ND_IOCTL_CALL` ioctl on the local libnvdimm character devices `/dev/ndctl%d` or `/dev/nmem%d`, requiring local system access. There is no remote or adjacent-network path into `acpi_nfit_ctl()`.\nAC:L - The attacker fully controls `nd_size_in`/`nd_size_out` in the ioctl payload, and the u32 overflow in `__nd_ioctl()` deterministically produces an undersized `vmalloc()` buffer on every attempt; the OOB read in `cmd_to_func()` occurs unconditionally before any command-mask validation. No race, timing window, or uninfluenceable memory layout is involved.\nPR:L - The entire path from `nd_ioctl()` through `acpi_nfit_ctl()` contains no `capable()` or capability check of any kind \u2014 access is gated only by filesystem permissions on the nvdimm device node plus the `O_RDONLY` rejection, so any account or container granted write access to `/dev/ndctl0`/`/dev/nmem0` (e.g. a delegated pmem-management group or a management container given the device) can trigger it. Since no in-kernel privilege gate exists, this is scored as low privileges rather than real root.\nUI:N - Exploitation is a single self-contained ioctl issued by the attacker\u0027s own process; no victim action, mount, or file open is required.\nS:U - The out-of-bounds access corrupts and discloses kernel memory within the same kernel security authority, and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - The undersized allocation causes reads of up to 40 bytes of stale kernel page data past the allocation (`nd_reserved2` and `nd_fw_size`), and the desynchronized `nd_size_in` is then passed to `acpi_evaluate_dsm()` as a buffer descriptor of attacker-chosen length (up to ~4 GB) pointing into the vmap area, exposing far more than a strictly bounded few bytes.\nI:H - The same undersized-buffer condition yields an out-of-bounds write: `call_pkg-\u003end_fw_size = out_obj-\u003ebuffer.length` writes 4 bytes past the allocation, and `memcpy(call_pkg-\u003end_payload + call_pkg-\u003end_size_in, ...)` writes DSM output to an attacker-controlled offset roughly 4 GB beyond `buf`. An out-of-bounds write with attacker-influenced destination and length is a control-flow-hijack-capable primitive.\nA:H - The OOB access triggers a KASAN BUG on hardened kernels, and on production kernels the ~4 GB buffer length handed to the ACPI interpreter and the wild `memcpy` destination in the vmap region reliably fault, producing a kernel oops or panic. The condition is trivially repeatable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:45:56.280Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/616aa5f3c86e0479bcbb81e41c08c43ff32af637"
        },
        {
          "url": "https://git.kernel.org/stable/c/bbdb3307f609ec4dc9558770f464ede01fe52aed"
        },
        {
          "url": "https://git.kernel.org/stable/c/143f723e9eb4f0302ffb7adfdc7ef77eab3f68e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/e08dc2dc3c3f7938df0e4476fe3e6fdec5583c1d"
        },
        {
          "url": "https://git.kernel.org/stable/c/212846fafb753a48e869e2a342fc1e24048da771"
        },
        {
          "url": "https://git.kernel.org/stable/c/265e98f72bac6c41a4492d3e30a8e5fd22fe0779"
        }
      ],
      "title": "acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56662",
    "datePublished": "2024-12-27T15:06:24.661Z",
    "dateReserved": "2024-12-27T15:00:39.843Z",
    "dateUpdated": "2026-08-05T11:45:56.280Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-56662",
      "date": "2026-09-16",
      "epss": "0.0061",
      "percentile": "0.47589"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-56662\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-27T15:15:26.073\",\"lastModified\":\"2026-08-04T11:22:19.407\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nacpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl\\n\\nFix an issue detected by syzbot with KASAN:\\n\\nBUG: KASAN: vmalloc-out-of-bounds in cmd_to_func drivers/acpi/nfit/\\ncore.c:416 [inline]\\nBUG: KASAN: vmalloc-out-of-bounds in acpi_nfit_ctl+0x20e8/0x24a0\\ndrivers/acpi/nfit/core.c:459\\n\\nThe issue occurs in cmd_to_func when the call_pkg-\u003end_reserved2\\narray is accessed without verifying that call_pkg points to a buffer\\nthat is appropriately sized as a struct nd_cmd_pkg. This can lead\\nto out-of-bounds access and undefined behavior if the buffer does not\\nhave sufficient space.\\n\\nTo address this, a check was added in acpi_nfit_ctl() to ensure that\\nbuf is not NULL and that buf_len is less than sizeof(*call_pkg)\\nbefore accessing it. This ensures safe access to the members of\\ncall_pkg, including the nd_reserved2 array.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: acpi: nfit: vmalloc-out-of-bounds Lectura en acpi_nfit_ctl Se soluciona un problema detectado por syzbot con KASAN: ERROR: KASAN: vmalloc-out-of-bounds en cmd_to_func drivers/acpi/nfit/ core.c:416 [en l\u00ednea] ERROR: KASAN: vmalloc-out-of-bounds en acpi_nfit_ctl+0x20e8/0x24a0 drivers/acpi/nfit/core.c:459 El problema ocurre en cmd_to_func cuando se accede a la matriz call_pkg-\u0026gt;nd_reserved2 sin verificar que call_pkg apunte a un b\u00fafer que tenga el tama\u00f1o adecuado como una estructura nd_cmd_pkg. Esto puede provocar un acceso fuera de los l\u00edmites y un comportamiento indefinido si el b\u00fafer no tiene suficiente espacio. Para solucionar este problema, se agreg\u00f3 una verificaci\u00f3n en acpi_nfit_ctl() para garantizar que buf no sea NULL y que buf_len sea menor que sizeof(*call_pkg) antes de acceder a \u00e9l. Esto garantiza un acceso seguro a los miembros de call_pkg, incluida la matriz nd_reserved2.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/acpi/nfit/core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ebe9f6f19d80d8978d16078dff3d5bd93ad8d102\",\"lessThan\":\"616aa5f3c86e0479bcbb81e41c08c43ff32af637\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ebe9f6f19d80d8978d16078dff3d5bd93ad8d102\",\"lessThan\":\"bbdb3307f609ec4dc9558770f464ede01fe52aed\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ebe9f6f19d80d8978d16078dff3d5bd93ad8d102\",\"lessThan\":\"143f723e9eb4f0302ffb7adfdc7ef77eab3f68e0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ebe9f6f19d80d8978d16078dff3d5bd93ad8d102\",\"lessThan\":\"e08dc2dc3c3f7938df0e4476fe3e6fdec5583c1d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ebe9f6f19d80d8978d16078dff3d5bd93ad8d102\",\"lessThan\":\"212846fafb753a48e869e2a342fc1e24048da771\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ebe9f6f19d80d8978d16078dff3d5bd93ad8d102\",\"lessThan\":\"265e98f72bac6c41a4492d3e30a8e5fd22fe0779\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"63108f2a408abea7ecab063efa0f398da4d0d14b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f5878c4f084dc6b1386dad03970bb61ad5e9dc4b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0c79794474895dbbc3c52225f7e9f73cfecbb7dd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4.14.176\",\"lessThan\":\"4.15\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.19.31\",\"lessThan\":\"4.20\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.0.4\",\"lessThan\":\"5.1\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/acpi/nfit/core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.1\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.1\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.232\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.175\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.121\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.67\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.6\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":6.0,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":0.8,\"impactScore\":5.2},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":6.0,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":0.8,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T19:59:57.981489Z\",\"id\":\"CVE-2024-56662\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.14.176\",\"versionEndExcluding\":\"4.15\",\"matchCriteriaId\":\"B6274D15-ED31-472F-B0FC-C76687469C95\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.19.31\",\"versionEndExcluding\":\"4.20\",\"matchCriteriaId\":\"C208F54A-1F85-44EF-9E91-6DA461A49CA0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.0.4\",\"versionEndExcluding\":\"5.10.232\",\"matchCriteriaId\":\"3B31FA24-D2AC-48A5-A29D-35820E219F8E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.175\",\"matchCriteriaId\":\"7A1F3620-6900-4852-9229-C3527377EBDA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.121\",\"matchCriteriaId\":\"D8DA16A0-9C6E-493E-90EE-309A34901477\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.67\",\"matchCriteriaId\":\"BF4F2CD1-2CA6-4D6B-9B0C-57C3C4D6544A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.6\",\"matchCriteriaId\":\"0CB1A9BB-F95E-43DD-A2FD-147912FD91E5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/143f723e9eb4f0302ffb7adfdc7ef77eab3f68e0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/212846fafb753a48e869e2a342fc1e24048da771\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/265e98f72bac6c41a4492d3e30a8e5fd22fe0779\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/616aa5f3c86e0479bcbb81e41c08c43ff32af637\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bbdb3307f609ec4dc9558770f464ede01fe52aed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e08dc2dc3c3f7938df0e4476fe3e6fdec5583c1d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T14:07:43+00:00",
      "cve": "CVE-2024-56662",
      "id": "CVE-2024-56662",
      "initial_release_date": "2024-12-27T00:00:00+00:00",
      "product_status:fixed": "612",
      "product_status:known_affected": "50",
      "product_status:known_not_affected": "62",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-56662.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T20:52:10.200Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.0, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-56662\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T19:59:57.981489Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-125\", \"description\": \"CWE-125 Out-of-bounds Read\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T15:45:19.658Z\"}}], \"cna\": {\"title\": \"acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerability is reached exclusively through the `ND_IOCTL_CALL` ioctl on the local libnvdimm character devices `/dev/ndctl%d` or `/dev/nmem%d`, requiring local system access. There is no remote or adjacent-network path into `acpi_nfit_ctl()`.\\nAC:L - The attacker fully controls `nd_size_in`/`nd_size_out` in the ioctl payload, and the u32 overflow in `__nd_ioctl()` deterministically produces an undersized `vmalloc()` buffer on every attempt; the OOB read in `cmd_to_func()` occurs unconditionally before any command-mask validation. No race, timing window, or uninfluenceable memory layout is involved.\\nPR:L - The entire path from `nd_ioctl()` through `acpi_nfit_ctl()` contains no `capable()` or capability check of any kind \\u2014 access is gated only by filesystem permissions on the nvdimm device node plus the `O_RDONLY` rejection, so any account or container granted write access to `/dev/ndctl0`/`/dev/nmem0` (e.g. a delegated pmem-management group or a management container given the device) can trigger it. Since no in-kernel privilege gate exists, this is scored as low privileges rather than real root.\\nUI:N - Exploitation is a single self-contained ioctl issued by the attacker\u0027s own process; no victim action, mount, or file open is required.\\nS:U - The out-of-bounds access corrupts and discloses kernel memory within the same kernel security authority, and does not cross a VM, IOMMU, or sandbox boundary.\\nC:H - The undersized allocation causes reads of up to 40 bytes of stale kernel page data past the allocation (`nd_reserved2` and `nd_fw_size`), and the desynchronized `nd_size_in` is then passed to `acpi_evaluate_dsm()` as a buffer descriptor of attacker-chosen length (up to ~4 GB) pointing into the vmap area, exposing far more than a strictly bounded few bytes.\\nI:H - The same undersized-buffer condition yields an out-of-bounds write: `call_pkg-\u003end_fw_size = out_obj-\u003ebuffer.length` writes 4 bytes past the allocation, and `memcpy(call_pkg-\u003end_payload + call_pkg-\u003end_size_in, ...)` writes DSM output to an attacker-controlled offset roughly 4 GB beyond `buf`. An out-of-bounds write with attacker-influenced destination and length is a control-flow-hijack-capable primitive.\\nA:H - The OOB access triggers a KASAN BUG on hardened kernels, and on production kernels the ~4 GB buffer length handed to the ACPI interpreter and the wild `memcpy` destination in the vmap region reliably fault, producing a kernel oops or panic. The condition is trivially repeatable.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"ebe9f6f19d80d8978d16078dff3d5bd93ad8d102\", \"lessThan\": \"616aa5f3c86e0479bcbb81e41c08c43ff32af637\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ebe9f6f19d80d8978d16078dff3d5bd93ad8d102\", \"lessThan\": \"bbdb3307f609ec4dc9558770f464ede01fe52aed\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ebe9f6f19d80d8978d16078dff3d5bd93ad8d102\", \"lessThan\": \"143f723e9eb4f0302ffb7adfdc7ef77eab3f68e0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ebe9f6f19d80d8978d16078dff3d5bd93ad8d102\", \"lessThan\": \"e08dc2dc3c3f7938df0e4476fe3e6fdec5583c1d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ebe9f6f19d80d8978d16078dff3d5bd93ad8d102\", \"lessThan\": \"212846fafb753a48e869e2a342fc1e24048da771\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ebe9f6f19d80d8978d16078dff3d5bd93ad8d102\", \"lessThan\": \"265e98f72bac6c41a4492d3e30a8e5fd22fe0779\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"63108f2a408abea7ecab063efa0f398da4d0d14b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f5878c4f084dc6b1386dad03970bb61ad5e9dc4b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0c79794474895dbbc3c52225f7e9f73cfecbb7dd\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4.14.176\", \"lessThan\": \"4.15\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"4.19.31\", \"lessThan\": \"4.20\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.0.4\", \"lessThan\": \"5.1\", \"versionType\": \"semver\"}], \"programFiles\": [\"drivers/acpi/nfit/core.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.1\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.1\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.232\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.175\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.121\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.67\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/acpi/nfit/core.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/616aa5f3c86e0479bcbb81e41c08c43ff32af637\"}, {\"url\": \"https://git.kernel.org/stable/c/bbdb3307f609ec4dc9558770f464ede01fe52aed\"}, {\"url\": \"https://git.kernel.org/stable/c/143f723e9eb4f0302ffb7adfdc7ef77eab3f68e0\"}, {\"url\": \"https://git.kernel.org/stable/c/e08dc2dc3c3f7938df0e4476fe3e6fdec5583c1d\"}, {\"url\": \"https://git.kernel.org/stable/c/212846fafb753a48e869e2a342fc1e24048da771\"}, {\"url\": \"https://git.kernel.org/stable/c/265e98f72bac6c41a4492d3e30a8e5fd22fe0779\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nacpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl\\n\\nFix an issue detected by syzbot with KASAN:\\n\\nBUG: KASAN: vmalloc-out-of-bounds in cmd_to_func drivers/acpi/nfit/\\ncore.c:416 [inline]\\nBUG: KASAN: vmalloc-out-of-bounds in acpi_nfit_ctl+0x20e8/0x24a0\\ndrivers/acpi/nfit/core.c:459\\n\\nThe issue occurs in cmd_to_func when the call_pkg-\u003end_reserved2\\narray is accessed without verifying that call_pkg points to a buffer\\nthat is appropriately sized as a struct nd_cmd_pkg. This can lead\\nto out-of-bounds access and undefined behavior if the buffer does not\\nhave sufficient space.\\n\\nTo address this, a check was added in acpi_nfit_ctl() to ensure that\\nbuf is not NULL and that buf_len is less than sizeof(*call_pkg)\\nbefore accessing it. This ensures safe access to the members of\\ncall_pkg, including the nd_reserved2 array.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.232\", \"versionStartIncluding\": \"5.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.175\", \"versionStartIncluding\": \"5.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.121\", \"versionStartIncluding\": \"5.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.67\", \"versionStartIncluding\": \"5.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.6\", \"versionStartIncluding\": \"5.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13\", \"versionStartIncluding\": \"5.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.14.176\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.19.31\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.0.4\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:45:56.280Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-56662\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:45:56.280Z\", \"dateReserved\": \"2024-12-27T15:00:39.843Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-12-27T15:06:24.661Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.