CVE-2024-36016 (GCVE-0-2024-36016)

Vulnerability from cvelistv5 – Published: 2024-05-29 18:46 – Updated: 2026-08-05 11:31
VLAI
Title
tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
Summary
In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: fix possible out-of-bounds in gsm0_receive() Assuming the following: - side A configures the n_gsm in basic option mode - side B sends the header of a basic option mode frame with data length 1 - side A switches to advanced option mode - side B sends 2 data bytes which exceeds gsm->len Reason: gsm->len is not used in advanced option mode. - side A switches to basic option mode - side B keeps sending until gsm0_receive() writes past gsm->buf Reason: Neither gsm->state nor gsm->len have been reset after reconfiguration. Fix this by changing gsm->count to gsm->len comparison from equal to less than. Also add upper limit checks against the constant MAX_MRU in gsm0_receive() and gsm1_receive() to harden against memory corruption of gsm->len and gsm->mru. All other checks remain as we still need to limit the data according to the user configuration and actual payload size.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.7 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: e1eaea46bb4020b38a141b84f88565d4603f8dd0 , < 9513d4148950b05bc99fa7314dc883cc0e1605e5 (git)
Affected: e1eaea46bb4020b38a141b84f88565d4603f8dd0 , < b229bc6c6ea9fe459fc3fa94fd0a27a2f32aca56 (git)
Affected: e1eaea46bb4020b38a141b84f88565d4603f8dd0 , < 0fb736c9931e02dbc7d9a75044c8e1c039e50f04 (git)
Affected: e1eaea46bb4020b38a141b84f88565d4603f8dd0 , < 4c267110fc110390704cc065edb9817fdd10ff54 (git)
Affected: e1eaea46bb4020b38a141b84f88565d4603f8dd0 , < 46f52c89a7e7d2691b97a9728e4591d071ca8abc (git)
Affected: e1eaea46bb4020b38a141b84f88565d4603f8dd0 , < 774d83b008eccb1c48c14dc5486e7aa255731350 (git)
Affected: e1eaea46bb4020b38a141b84f88565d4603f8dd0 , < f126ce7305fe88f49cdabc6db4168b9318898ea3 (git)
Affected: e1eaea46bb4020b38a141b84f88565d4603f8dd0 , < b890d45aaf02b564e6cae2d2a590f9649330857d (git)
Affected: e1eaea46bb4020b38a141b84f88565d4603f8dd0 , < 47388e807f85948eefc403a8a5fdc5b406a65d5a (git)
Create a notification for this product.
Linux Linux Affected: 2.6.35
Unaffected: 0 , < 2.6.35 (semver)
Unaffected: 4.19.316 , ≤ 4.19.* (semver)
Unaffected: 5.4.278 , ≤ 5.4.* (semver)
Unaffected: 5.10.219 , ≤ 5.10.* (semver)
Unaffected: 5.15.161 , ≤ 5.15.* (semver)
Unaffected: 6.1.93 , ≤ 6.1.* (semver)
Unaffected: 6.6.33 , ≤ 6.6.* (semver)
Unaffected: 6.8.12 , ≤ 6.8.* (semver)
Unaffected: 6.9.3 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
Create a notification for this product.
linux linux_kernel Affected: e1eaea46bb40 , < b890d45aaf02 (custom)
    cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
 Create a notification for this product.
linux linux_kernel Affected: e1eaea46bb40 , < 47388e807f85 (custom)
    cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
 Create a notification for this product.
linux linux_kernel Affected: 2.6.35
    cpe:2.3:o:linux:linux_kernel:2.6.35:*:*:*:*:*:*:*
 Create a notification for this product.
linux linux_kernel Affected: e1eaea46bb40 , < f126ce7305fe (custom)
Affected: e1eaea46bb40 , < 9513d4148950 (custom)
Affected: e1eaea46bb40 , < b229bc6c6ea9 (custom)
Affected: e1eaea46bb40 , < 0fb736c9931e (custom)
Affected: e1eaea46bb40 , < 4c267110fc11 (custom)
Affected: e1eaea46bb40 , ≤ 46f52c89a7e7 (custom)
Affected: e1eaea46bb40 , < 774d83b008ec (custom)
Unaffected: 0 , < 2.6.35 (custom)
Unaffected: 4.19.316 , ≤ 4.20 (custom)
Unaffected: 5.4.278 , ≤ 5.5 (custom)
Unaffected: 5.10.219 , ≤ 5.11 (custom)
Unaffected: 5.15.161 , ≤ 5.16 (custom)
Unaffected: 6.1.93 , ≤ 6.2 (custom)
Unaffected: 6.6.33 , ≤ 6.7 (custom)
Unaffected: 6.8.12 , ≤ 6.9 (custom)
Unaffected: 6.9.3 , ≤ 6.10 (custom)
Unaffected: 6.10 , ≤ * (custom)
    cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
 Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "b890d45aaf02",
                "status": "affected",
                "version": "e1eaea46bb40",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "47388e807f85",
                "status": "affected",
                "version": "e1eaea46bb40",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:2.6.35:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "affected",
                "version": "2.6.35"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "f126ce7305fe",
                "status": "affected",
                "version": "e1eaea46bb40",
                "versionType": "custom"
              },
              {
                "lessThan": "9513d4148950",
                "status": "affected",
                "version": "e1eaea46bb40",
                "versionType": "custom"
              },
              {
                "lessThan": "b229bc6c6ea9",
                "status": "affected",
                "version": "e1eaea46bb40",
                "versionType": "custom"
              },
              {
                "lessThan": "0fb736c9931e",
                "status": "affected",
                "version": "e1eaea46bb40",
                "versionType": "custom"
              },
              {
                "lessThan": "4c267110fc11",
                "status": "affected",
                "version": "e1eaea46bb40",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "46f52c89a7e7",
                "status": "affected",
                "version": "e1eaea46bb40",
                "versionType": "custom"
              },
              {
                "lessThan": "774d83b008ec",
                "status": "affected",
                "version": "e1eaea46bb40",
                "versionType": "custom"
              },
              {
                "lessThan": "2.6.35",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "4.20",
                "status": "unaffected",
                "version": "4.19.316",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "5.5",
                "status": "unaffected",
                "version": "5.4.278",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "5.11",
                "status": "unaffected",
                "version": "5.10.219",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "5.16",
                "status": "unaffected",
                "version": "5.15.161",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "6.2",
                "status": "unaffected",
                "version": "6.1.93",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "6.7",
                "status": "unaffected",
                "version": "6.6.33",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "6.9",
                "status": "unaffected",
                "version": "6.8.12",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "6.10",
                "status": "unaffected",
                "version": "6.9.3",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "6.10",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-36016",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-30T18:00:26.164343Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "CWE-125 Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-22T17:58:33.311Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:20:57.711Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9513d4148950b05bc99fa7314dc883cc0e1605e5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b229bc6c6ea9fe459fc3fa94fd0a27a2f32aca56"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0fb736c9931e02dbc7d9a75044c8e1c039e50f04"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4c267110fc110390704cc065edb9817fdd10ff54"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/46f52c89a7e7d2691b97a9728e4591d071ca8abc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/774d83b008eccb1c48c14dc5486e7aa255731350"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f126ce7305fe88f49cdabc6db4168b9318898ea3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b890d45aaf02b564e6cae2d2a590f9649330857d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/47388e807f85948eefc403a8a5fdc5b406a65d5a"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/tty/n_gsm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9513d4148950b05bc99fa7314dc883cc0e1605e5",
              "status": "affected",
              "version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0",
              "versionType": "git"
            },
            {
              "lessThan": "b229bc6c6ea9fe459fc3fa94fd0a27a2f32aca56",
              "status": "affected",
              "version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0",
              "versionType": "git"
            },
            {
              "lessThan": "0fb736c9931e02dbc7d9a75044c8e1c039e50f04",
              "status": "affected",
              "version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0",
              "versionType": "git"
            },
            {
              "lessThan": "4c267110fc110390704cc065edb9817fdd10ff54",
              "status": "affected",
              "version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0",
              "versionType": "git"
            },
            {
              "lessThan": "46f52c89a7e7d2691b97a9728e4591d071ca8abc",
              "status": "affected",
              "version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0",
              "versionType": "git"
            },
            {
              "lessThan": "774d83b008eccb1c48c14dc5486e7aa255731350",
              "status": "affected",
              "version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0",
              "versionType": "git"
            },
            {
              "lessThan": "f126ce7305fe88f49cdabc6db4168b9318898ea3",
              "status": "affected",
              "version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0",
              "versionType": "git"
            },
            {
              "lessThan": "b890d45aaf02b564e6cae2d2a590f9649330857d",
              "status": "affected",
              "version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0",
              "versionType": "git"
            },
            {
              "lessThan": "47388e807f85948eefc403a8a5fdc5b406a65d5a",
              "status": "affected",
              "version": "e1eaea46bb4020b38a141b84f88565d4603f8dd0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/tty/n_gsm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.35"
            },
            {
              "lessThan": "2.6.35",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.316",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.278",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.219",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.161",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.316",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.278",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.219",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.161",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.93",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.33",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.12",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.3",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: n_gsm: fix possible out-of-bounds in gsm0_receive()\n\nAssuming the following:\n- side A configures the n_gsm in basic option mode\n- side B sends the header of a basic option mode frame with data length 1\n- side A switches to advanced option mode\n- side B sends 2 data bytes which exceeds gsm-\u003elen\n  Reason: gsm-\u003elen is not used in advanced option mode.\n- side A switches to basic option mode\n- side B keeps sending until gsm0_receive() writes past gsm-\u003ebuf\n  Reason: Neither gsm-\u003estate nor gsm-\u003elen have been reset after\n  reconfiguration.\n\nFix this by changing gsm-\u003ecount to gsm-\u003elen comparison from equal to less\nthan. Also add upper limit checks against the constant MAX_MRU in\ngsm0_receive() and gsm1_receive() to harden against memory corruption of\ngsm-\u003elen and gsm-\u003emru.\n\nAll other checks remain as we still need to limit the data according to the\nuser configuration and actual payload size."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation is entirely local \u2014 the attacker opens /dev/ptmx, attaches the N_GSM0710 line discipline via TIOCSETD, drives mode switches with the GSMIOC_SETCONF ioctl, and feeds the malicious byte stream by writing to the pty master. No network or physical access is involved.\nAC:L - The attacker controls both sides of the pty pair, so the exact sequence (fill count in advanced mode, reconfigure to basic mode, keep writing) is deterministic and requires no race or unpredictable memory state. A tested proof of concept was attached to the upstream bug report (bugzilla 218708).\nPR:L - Across most of the affected range (2.6.35 through 6.5, and stable trees prior to the Aug-2023 backport of 67c37756898a), attaching N_GSM0710 required no privileges whatsoever, and GSMIOC_SETCONF has no capability check at all \u2014 so a plain unprivileged local account with a pty is sufficient.\nUI:N - The attacker performs every step \u2014 ldisc attach, reconfiguration, and data injection \u2014 without any action by another user or victim process.\nS:U - The heap corruption occurs in kernel memory belonging to the same security authority as the kernel itself; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The desynced count/len are also used by gsm_fcs_add_block() and dlci-\u003edata(dlci, gsm-\u003ebuf, gsm-\u003elen), producing out-of-bounds reads whose contents are delivered into DLCI tty buffers the attacker can read back, and the heap overflow primitive can be leveraged for broader kernel memory disclosure.\nI:H - This is an unbounded linear heap buffer overflow past a 1501-byte kmalloc\u0027d object with fully attacker-controlled bytes and attacker-chosen length, giving control over adjacent kmalloc-2k slab objects \u2014 a strong primitive for arbitrary write and control-flow hijacking.\nA:H - Overwriting arbitrary amounts of adjacent slab memory reliably corrupts kernel data structures and slab metadata, causing oops or panic; the reporter observed memory corruption in practice."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:31:37.096Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9513d4148950b05bc99fa7314dc883cc0e1605e5"
        },
        {
          "url": "https://git.kernel.org/stable/c/b229bc6c6ea9fe459fc3fa94fd0a27a2f32aca56"
        },
        {
          "url": "https://git.kernel.org/stable/c/0fb736c9931e02dbc7d9a75044c8e1c039e50f04"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c267110fc110390704cc065edb9817fdd10ff54"
        },
        {
          "url": "https://git.kernel.org/stable/c/46f52c89a7e7d2691b97a9728e4591d071ca8abc"
        },
        {
          "url": "https://git.kernel.org/stable/c/774d83b008eccb1c48c14dc5486e7aa255731350"
        },
        {
          "url": "https://git.kernel.org/stable/c/f126ce7305fe88f49cdabc6db4168b9318898ea3"
        },
        {
          "url": "https://git.kernel.org/stable/c/b890d45aaf02b564e6cae2d2a590f9649330857d"
        },
        {
          "url": "https://git.kernel.org/stable/c/47388e807f85948eefc403a8a5fdc5b406a65d5a"
        }
      ],
      "title": "tty: n_gsm: fix possible out-of-bounds in gsm0_receive()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-36016",
    "datePublished": "2024-05-29T18:46:34.778Z",
    "dateReserved": "2024-05-17T13:50:33.154Z",
    "dateUpdated": "2026-08-05T11:31:37.096Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-36016",
      "date": "2026-08-05",
      "epss": "0.00265",
      "percentile": "0.18208"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-36016\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-29T19:15:48.297\",\"lastModified\":\"2026-06-17T07:35:57.650\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntty: n_gsm: fix possible out-of-bounds in gsm0_receive()\\n\\nAssuming the following:\\n- side A configures the n_gsm in basic option mode\\n- side B sends the header of a basic option mode frame with data length 1\\n- side A switches to advanced option mode\\n- side B sends 2 data bytes which exceeds gsm-\u003elen\\n  Reason: gsm-\u003elen is not used in advanced option mode.\\n- side A switches to basic option mode\\n- side B keeps sending until gsm0_receive() writes past gsm-\u003ebuf\\n  Reason: Neither gsm-\u003estate nor gsm-\u003elen have been reset after\\n  reconfiguration.\\n\\nFix this by changing gsm-\u003ecount to gsm-\u003elen comparison from equal to less\\nthan. Also add upper limit checks against the constant MAX_MRU in\\ngsm0_receive() and gsm1_receive() to harden against memory corruption of\\ngsm-\u003elen and gsm-\u003emru.\\n\\nAll other checks remain as we still need to limit the data according to the\\nuser configuration and actual payload size.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: tty: n_gsm: corrige posibles fuera de los l\u00edmites en gsm0_receive() Suponiendo lo siguiente: - el lado A configura el n_gsm en modo de opci\u00f3n b\u00e1sica - el lado B env\u00eda el encabezado de un mensaje b\u00e1sico trama del modo de opci\u00f3n con longitud de datos 1 - el lado A cambia al modo de opci\u00f3n avanzada - el lado B env\u00eda 2 bytes de datos que exceden gsm-\u0026gt;len Motivo: gsm-\u0026gt;len no se usa en el modo de opci\u00f3n avanzada. - el lado A cambia al modo de opci\u00f3n b\u00e1sica - el lado B contin\u00faa enviando hasta que gsm0_receive() escribe m\u00e1s all\u00e1 de gsm-\u0026gt;buf Motivo: Ni gsm-\u0026gt;state ni gsm-\u0026gt;len se han restablecido despu\u00e9s de la reconfiguraci\u00f3n. Solucione este problema cambiando gsm-\u0026gt;count a gsm-\u0026gt;len comparaci\u00f3n de igual a menor que. Tambi\u00e9n agregue comprobaciones de l\u00edmite superior contra la constante MAX_MRU en gsm0_receive() y gsm1_receive() para proteger contra la corrupci\u00f3n de memoria de gsm-\u0026gt;len y gsm-\u0026gt;mru. Todas las dem\u00e1s comprobaciones permanecen, ya que todav\u00eda necesitamos limitar los datos seg\u00fan la configuraci\u00f3n del usuario y el tama\u00f1o real del payload.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/tty/n_gsm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e1eaea46bb4020b38a141b84f88565d4603f8dd0\",\"lessThan\":\"9513d4148950b05bc99fa7314dc883cc0e1605e5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e1eaea46bb4020b38a141b84f88565d4603f8dd0\",\"lessThan\":\"b229bc6c6ea9fe459fc3fa94fd0a27a2f32aca56\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e1eaea46bb4020b38a141b84f88565d4603f8dd0\",\"lessThan\":\"0fb736c9931e02dbc7d9a75044c8e1c039e50f04\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e1eaea46bb4020b38a141b84f88565d4603f8dd0\",\"lessThan\":\"4c267110fc110390704cc065edb9817fdd10ff54\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e1eaea46bb4020b38a141b84f88565d4603f8dd0\",\"lessThan\":\"46f52c89a7e7d2691b97a9728e4591d071ca8abc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e1eaea46bb4020b38a141b84f88565d4603f8dd0\",\"lessThan\":\"774d83b008eccb1c48c14dc5486e7aa255731350\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e1eaea46bb4020b38a141b84f88565d4603f8dd0\",\"lessThan\":\"f126ce7305fe88f49cdabc6db4168b9318898ea3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e1eaea46bb4020b38a141b84f88565d4603f8dd0\",\"lessThan\":\"b890d45aaf02b564e6cae2d2a590f9649330857d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e1eaea46bb4020b38a141b84f88565d4603f8dd0\",\"lessThan\":\"47388e807f85948eefc403a8a5fdc5b406a65d5a\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/tty/n_gsm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.35\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.35\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.316\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.278\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.219\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.161\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.93\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.33\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.12\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.3\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"affectedData\":[{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"e1eaea46bb40\",\"lessThan\":\"b890d45aaf02\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"e1eaea46bb40\",\"lessThan\":\"47388e807f85\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:2.6.35:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"2.6.35\",\"status\":\"affected\"}]},{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"e1eaea46bb40\",\"lessThan\":\"f126ce7305fe\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"e1eaea46bb40\",\"lessThan\":\"9513d4148950\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"e1eaea46bb40\",\"lessThan\":\"b229bc6c6ea9\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"e1eaea46bb40\",\"lessThan\":\"0fb736c9931e\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"e1eaea46bb40\",\"lessThan\":\"4c267110fc11\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"e1eaea46bb40\",\"lessThanOrEqual\":\"46f52c89a7e7\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"e1eaea46bb40\",\"lessThan\":\"774d83b008ec\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.35\",\"versionType\":\"custom\",\"status\":\"unaffected\"},{\"version\":\"4.19.316\",\"lessThanOrEqual\":\"4.20\",\"versionType\":\"custom\",\"status\":\"unaffected\"},{\"version\":\"5.4.278\",\"lessThanOrEqual\":\"5.5\",\"versionType\":\"custom\",\"status\":\"unaffected\"},{\"version\":\"5.10.219\",\"lessThanOrEqual\":\"5.11\",\"versionType\":\"custom\",\"status\":\"unaffected\"},{\"version\":\"5.15.161\",\"lessThanOrEqual\":\"5.16\",\"versionType\":\"custom\",\"status\":\"unaffected\"},{\"version\":\"6.1.93\",\"lessThanOrEqual\":\"6.2\",\"versionType\":\"custom\",\"status\":\"unaffected\"},{\"version\":\"6.6.33\",\"lessThanOrEqual\":\"6.7\",\"versionType\":\"custom\",\"status\":\"unaffected\"},{\"version\":\"6.8.12\",\"lessThanOrEqual\":\"6.9\",\"versionType\":\"custom\",\"status\":\"unaffected\"},{\"version\":\"6.9.3\",\"lessThanOrEqual\":\"6.10\",\"versionType\":\"custom\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"custom\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.7,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-05-30T18:00:26.164343Z\",\"id\":\"CVE-2024-36016\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.35\",\"versionEndExcluding\":\"4.19.316\",\"matchCriteriaId\":\"1BF99E52-091D-4D39-8639-6E3471FEBD3A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.278\",\"matchCriteriaId\":\"7FDBF235-DA18-49A1-8690-6C7272FD0701\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.219\",\"matchCriteriaId\":\"E9063AF3-D593-43B7-810D-58B87F82F9F9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.161\",\"matchCriteriaId\":\"31130639-53FE-4726-8986-434EE2528CB2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.93\",\"matchCriteriaId\":\"EEFB78EE-F990-4197-BF1C-156760A55667\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.33\",\"matchCriteriaId\":\"FCE796DF-3B50-4DC6-BAE5-95271068FC9E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.12\",\"matchCriteriaId\":\"80550309-67AB-4FD1-AC07-3DED5C4F01B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.9\",\"versionEndExcluding\":\"6.9.3\",\"matchCriteriaId\":\"E07124C1-19E8-4D21-828D-9932A01D3011\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0fb736c9931e02dbc7d9a75044c8e1c039e50f04\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/46f52c89a7e7d2691b97a9728e4591d071ca8abc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/47388e807f85948eefc403a8a5fdc5b406a65d5a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4c267110fc110390704cc065edb9817fdd10ff54\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/774d83b008eccb1c48c14dc5486e7aa255731350\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9513d4148950b05bc99fa7314dc883cc0e1605e5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b229bc6c6ea9fe459fc3fa94fd0a27a2f32aca56\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b890d45aaf02b564e6cae2d2a590f9649330857d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f126ce7305fe88f49cdabc6db4168b9318898ea3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0fb736c9931e02dbc7d9a75044c8e1c039e50f04\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/46f52c89a7e7d2691b97a9728e4591d071ca8abc\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/47388e807f85948eefc403a8a5fdc5b406a65d5a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4c267110fc110390704cc065edb9817fdd10ff54\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/774d83b008eccb1c48c14dc5486e7aa255731350\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9513d4148950b05bc99fa7314dc883cc0e1605e5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b229bc6c6ea9fe459fc3fa94fd0a27a2f32aca56\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b890d45aaf02b564e6cae2d2a590f9649330857d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f126ce7305fe88f49cdabc6db4168b9318898ea3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T12:50:20+00:00",
      "cve": "CVE-2024-36016",
      "id": "CVE-2024-36016",
      "initial_release_date": "2024-05-29T00:00:00+00:00",
      "product_status:fixed": "926",
      "product_status:known_affected": "50",
      "product_status:known_not_affected": "18",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tty: n_gsm: fix possible out-of-bounds in gsm0_receive()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-36016.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/9513d4148950b05bc99fa7314dc883cc0e1605e5\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/b229bc6c6ea9fe459fc3fa94fd0a27a2f32aca56\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0fb736c9931e02dbc7d9a75044c8e1c039e50f04\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/4c267110fc110390704cc065edb9817fdd10ff54\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/46f52c89a7e7d2691b97a9728e4591d071ca8abc\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/774d83b008eccb1c48c14dc5486e7aa255731350\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/f126ce7305fe88f49cdabc6db4168b9318898ea3\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/b890d45aaf02b564e6cae2d2a590f9649330857d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/47388e807f85948eefc403a8a5fdc5b406a65d5a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-04T17:20:57.711Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.7, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-36016\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-30T18:00:26.164343Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"e1eaea46bb40\", \"lessThan\": \"b890d45aaf02\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"e1eaea46bb40\", \"lessThan\": \"47388e807f85\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:2.6.35:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.35\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"e1eaea46bb40\", \"lessThan\": \"f126ce7305fe\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"e1eaea46bb40\", \"lessThan\": \"9513d4148950\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"e1eaea46bb40\", \"lessThan\": \"b229bc6c6ea9\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"e1eaea46bb40\", \"lessThan\": \"0fb736c9931e\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"e1eaea46bb40\", \"lessThan\": \"4c267110fc11\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"e1eaea46bb40\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"46f52c89a7e7\"}, {\"status\": \"affected\", \"version\": \"e1eaea46bb40\", \"lessThan\": \"774d83b008ec\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.35\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"4.19.316\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.20\"}, {\"status\": \"unaffected\", \"version\": \"5.4.278\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.5\"}, {\"status\": \"unaffected\", \"version\": \"5.10.219\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.11\"}, {\"status\": \"unaffected\", \"version\": \"5.15.161\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.16\"}, {\"status\": \"unaffected\", \"version\": \"6.1.93\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.2\"}, {\"status\": \"unaffected\", \"version\": \"6.6.33\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.7\"}, {\"status\": \"unaffected\", \"version\": \"6.8.12\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.9\"}, {\"status\": \"unaffected\", \"version\": \"6.9.3\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.10\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"*\"}], \"defaultStatus\": \"unknown\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-125\", \"description\": \"CWE-125 Out-of-bounds Read\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-30T18:11:07.936Z\"}}], \"cna\": {\"title\": \"tty: n_gsm: fix possible out-of-bounds in gsm0_receive()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - Exploitation is entirely local \\u2014 the attacker opens /dev/ptmx, attaches the N_GSM0710 line discipline via TIOCSETD, drives mode switches with the GSMIOC_SETCONF ioctl, and feeds the malicious byte stream by writing to the pty master. No network or physical access is involved.\\nAC:L - The attacker controls both sides of the pty pair, so the exact sequence (fill count in advanced mode, reconfigure to basic mode, keep writing) is deterministic and requires no race or unpredictable memory state. A tested proof of concept was attached to the upstream bug report (bugzilla 218708).\\nPR:L - Across most of the affected range (2.6.35 through 6.5, and stable trees prior to the Aug-2023 backport of 67c37756898a), attaching N_GSM0710 required no privileges whatsoever, and GSMIOC_SETCONF has no capability check at all \\u2014 so a plain unprivileged local account with a pty is sufficient.\\nUI:N - The attacker performs every step \\u2014 ldisc attach, reconfiguration, and data injection \\u2014 without any action by another user or victim process.\\nS:U - The heap corruption occurs in kernel memory belonging to the same security authority as the kernel itself; no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - The desynced count/len are also used by gsm_fcs_add_block() and dlci-\u003edata(dlci, gsm-\u003ebuf, gsm-\u003elen), producing out-of-bounds reads whose contents are delivered into DLCI tty buffers the attacker can read back, and the heap overflow primitive can be leveraged for broader kernel memory disclosure.\\nI:H - This is an unbounded linear heap buffer overflow past a 1501-byte kmalloc\u0027d object with fully attacker-controlled bytes and attacker-chosen length, giving control over adjacent kmalloc-2k slab objects \\u2014 a strong primitive for arbitrary write and control-flow hijacking.\\nA:H - Overwriting arbitrary amounts of adjacent slab memory reliably corrupts kernel data structures and slab metadata, causing oops or panic; the reporter observed memory corruption in practice.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"e1eaea46bb4020b38a141b84f88565d4603f8dd0\", \"lessThan\": \"9513d4148950b05bc99fa7314dc883cc0e1605e5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e1eaea46bb4020b38a141b84f88565d4603f8dd0\", \"lessThan\": \"b229bc6c6ea9fe459fc3fa94fd0a27a2f32aca56\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e1eaea46bb4020b38a141b84f88565d4603f8dd0\", \"lessThan\": \"0fb736c9931e02dbc7d9a75044c8e1c039e50f04\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e1eaea46bb4020b38a141b84f88565d4603f8dd0\", \"lessThan\": \"4c267110fc110390704cc065edb9817fdd10ff54\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e1eaea46bb4020b38a141b84f88565d4603f8dd0\", \"lessThan\": \"46f52c89a7e7d2691b97a9728e4591d071ca8abc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e1eaea46bb4020b38a141b84f88565d4603f8dd0\", \"lessThan\": \"774d83b008eccb1c48c14dc5486e7aa255731350\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e1eaea46bb4020b38a141b84f88565d4603f8dd0\", \"lessThan\": \"f126ce7305fe88f49cdabc6db4168b9318898ea3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e1eaea46bb4020b38a141b84f88565d4603f8dd0\", \"lessThan\": \"b890d45aaf02b564e6cae2d2a590f9649330857d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e1eaea46bb4020b38a141b84f88565d4603f8dd0\", \"lessThan\": \"47388e807f85948eefc403a8a5fdc5b406a65d5a\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/tty/n_gsm.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.35\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.35\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.316\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.278\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.219\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.161\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.93\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.33\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/tty/n_gsm.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/9513d4148950b05bc99fa7314dc883cc0e1605e5\"}, {\"url\": \"https://git.kernel.org/stable/c/b229bc6c6ea9fe459fc3fa94fd0a27a2f32aca56\"}, {\"url\": \"https://git.kernel.org/stable/c/0fb736c9931e02dbc7d9a75044c8e1c039e50f04\"}, {\"url\": \"https://git.kernel.org/stable/c/4c267110fc110390704cc065edb9817fdd10ff54\"}, {\"url\": \"https://git.kernel.org/stable/c/46f52c89a7e7d2691b97a9728e4591d071ca8abc\"}, {\"url\": \"https://git.kernel.org/stable/c/774d83b008eccb1c48c14dc5486e7aa255731350\"}, {\"url\": \"https://git.kernel.org/stable/c/f126ce7305fe88f49cdabc6db4168b9318898ea3\"}, {\"url\": \"https://git.kernel.org/stable/c/b890d45aaf02b564e6cae2d2a590f9649330857d\"}, {\"url\": \"https://git.kernel.org/stable/c/47388e807f85948eefc403a8a5fdc5b406a65d5a\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntty: n_gsm: fix possible out-of-bounds in gsm0_receive()\\n\\nAssuming the following:\\n- side A configures the n_gsm in basic option mode\\n- side B sends the header of a basic option mode frame with data length 1\\n- side A switches to advanced option mode\\n- side B sends 2 data bytes which exceeds gsm-\u003elen\\n  Reason: gsm-\u003elen is not used in advanced option mode.\\n- side A switches to basic option mode\\n- side B keeps sending until gsm0_receive() writes past gsm-\u003ebuf\\n  Reason: Neither gsm-\u003estate nor gsm-\u003elen have been reset after\\n  reconfiguration.\\n\\nFix this by changing gsm-\u003ecount to gsm-\u003elen comparison from equal to less\\nthan. Also add upper limit checks against the constant MAX_MRU in\\ngsm0_receive() and gsm1_receive() to harden against memory corruption of\\ngsm-\u003elen and gsm-\u003emru.\\n\\nAll other checks remain as we still need to limit the data according to the\\nuser configuration and actual payload size.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.316\", \"versionStartIncluding\": \"2.6.35\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.278\", \"versionStartIncluding\": \"2.6.35\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.219\", \"versionStartIncluding\": \"2.6.35\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.161\", \"versionStartIncluding\": \"2.6.35\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.93\", \"versionStartIncluding\": \"2.6.35\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.33\", \"versionStartIncluding\": \"2.6.35\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.12\", \"versionStartIncluding\": \"2.6.35\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.3\", \"versionStartIncluding\": \"2.6.35\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"2.6.35\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:31:37.096Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-36016\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:31:37.096Z\", \"dateReserved\": \"2024-05-17T13:50:33.154Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-29T18:46:34.778Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.