CVE-2024-26599 - Vulnerability Details - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: pwm: Fix out-of-bounds access in of_pwm_single_xlate() With args->args_count == 2 args->args[2] is not defined. Actually the flags are contained in args->args[1].

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Linux	Linux Kernel

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

References

Link	Providers
https://git.kernel.org/stable/c/7b85554c7c2aee91171e038e4d5442ffa130b282
https://git.kernel.org/stable/c/a297d07b9a1e4fb8cda25a4a2363a507d294b7c9
https://git.kernel.org/stable/c/bae45b7ebb31984b63b13c3519fd724b3ce92123
https://git.kernel.org/stable/c/e5f2b4b62977fb6c2efcbc5779e0c9dce18215f7
https://lore.kernel.org/linux-cve-announce/2024022338-CVE-2024-26599-cd65@gregkh/T/#u
https://nvd.nist.gov/vuln/detail/CVE-2024-26599
https://www.cve.org/CVERecord?id=CVE-2024-26599

History

Tue, 05 Nov 2024 10:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-02-23T14:46:27.290Z

Updated: 2024-12-19T08:43:17.307Z

Reserved: 2024-02-19T14:20:24.128Z

Link: CVE-2024-26599

Vulnrichment

Updated: 2024-08-02T00:07:19.631Z

NVD

Status : Modified

Published: 2024-02-23T15:15:09.660

Modified: 2024-11-21T09:02:37.853

Link: CVE-2024-26599

Redhat

Severity : Moderate

Publid Date: 2024-02-23T00:00:00Z

Links: CVE-2024-26599 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-26599", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.128Z", "datePublished": "2024-02-23T14:46:27.290Z", "dateUpdated": "2024-12-19T08:43:17.307Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-12-19T08:43:17.307Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npwm: Fix out-of-bounds access in of_pwm_single_xlate()\n\nWith args->args_count == 2 args->args[2] is not defined. Actually the\nflags are contained in args->args[1]."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/pwm/core.c"], "versions": [{"version": "3ab7b6ac5d829e60c3b89d415811ff1c9f358c8e", "lessThan": "7b85554c7c2aee91171e038e4d5442ffa130b282", "status": "affected", "versionType": "git"}, {"version": "3ab7b6ac5d829e60c3b89d415811ff1c9f358c8e", "lessThan": "e5f2b4b62977fb6c2efcbc5779e0c9dce18215f7", "status": "affected", "versionType": "git"}, {"version": "3ab7b6ac5d829e60c3b89d415811ff1c9f358c8e", "lessThan": "bae45b7ebb31984b63b13c3519fd724b3ce92123", "status": "affected", "versionType": "git"}, {"version": "3ab7b6ac5d829e60c3b89d415811ff1c9f358c8e", "lessThan": "a297d07b9a1e4fb8cda25a4a2363a507d294b7c9", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/pwm/core.c"], "versions": [{"version": "5.17", "status": "affected"}, {"version": "0", "lessThan": "5.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.75", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.14", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.2", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/7b85554c7c2aee91171e038e4d5442ffa130b282"}, {"url": "https://git.kernel.org/stable/c/e5f2b4b62977fb6c2efcbc5779e0c9dce18215f7"}, {"url": "https://git.kernel.org/stable/c/bae45b7ebb31984b63b13c3519fd724b3ce92123"}, {"url": "https://git.kernel.org/stable/c/a297d07b9a1e4fb8cda25a4a2363a507d294b7c9"}], "title": "pwm: Fix out-of-bounds access in of_pwm_single_xlate()", "x_generator": {"engine": "bippy-5f407fcff5a0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26599", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-04T21:04:42.886964Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:48:34.177Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:07:19.631Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/7b85554c7c2aee91171e038e4d5442ffa130b282", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e5f2b4b62977fb6c2efcbc5779e0c9dce18215f7", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/bae45b7ebb31984b63b13c3519fd724b3ce92123", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/a297d07b9a1e4fb8cda25a4a2363a507d294b7c9", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/7b85554c7c2aee91171e038e4d5442ffa130b282", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e5f2b4b62977fb6c2efcbc5779e0c9dce18215f7", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/bae45b7ebb31984b63b13c3519fd724b3ce92123", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/a297d07b9a1e4fb8cda25a4a2363a507d294b7c9", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:07:19.631Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26599", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-04T21:04:42.886964Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:14.921Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "pwm: Fix out-of-bounds access in of_pwm_single_xlate()", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3ab7b6ac5d829e60c3b89d415811ff1c9f358c8e", "lessThan": "7b85554c7c2aee91171e038e4d5442ffa130b282", "versionType": "git"}, {"status": "affected", "version": "3ab7b6ac5d829e60c3b89d415811ff1c9f358c8e", "lessThan": "e5f2b4b62977fb6c2efcbc5779e0c9dce18215f7", "versionType": "git"}, {"status": "affected", "version": "3ab7b6ac5d829e60c3b89d415811ff1c9f358c8e", "lessThan": "bae45b7ebb31984b63b13c3519fd724b3ce92123", "versionType": "git"}, {"status": "affected", "version": "3ab7b6ac5d829e60c3b89d415811ff1c9f358c8e", "lessThan": "a297d07b9a1e4fb8cda25a4a2363a507d294b7c9", "versionType": "git"}], "programFiles": ["drivers/pwm/core.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.17"}, {"status": "unaffected", "version": "0", "lessThan": "5.17", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.75", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.14", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7.2", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/pwm/core.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/7b85554c7c2aee91171e038e4d5442ffa130b282"}, {"url": "https://git.kernel.org/stable/c/e5f2b4b62977fb6c2efcbc5779e0c9dce18215f7"}, {"url": "https://git.kernel.org/stable/c/bae45b7ebb31984b63b13c3519fd724b3ce92123"}, {"url": "https://git.kernel.org/stable/c/a297d07b9a1e4fb8cda25a4a2363a507d294b7c9"}], "x_generator": {"engine": "bippy-5f407fcff5a0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npwm: Fix out-of-bounds access in of_pwm_single_xlate()\n\nWith args->args_count == 2 args->args[2] is not defined. Actually the\nflags are contained in args->args[1]."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-12-19T08:43:17.307Z"}}}, "cveMetadata": {"cveId": "CVE-2024-26599", "state": "PUBLISHED", "dateUpdated": "2024-12-19T08:43:17.307Z", "dateReserved": "2024-02-19T14:20:24.128Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-02-23T14:46:27.290Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "DB5C8DA6-49C9-4423-ACFE-969306B07B9E", "versionEndExcluding": "6.1.75", "versionStartIncluding": "5.17", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BDBBEB0E-D13A-4567-8984-51C5375350B9", "versionEndExcluding": "6.6.14", "versionStartIncluding": "6.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0EA3778C-730B-464C-8023-18CA6AC0B807", "versionEndExcluding": "6.7.2", "versionStartIncluding": "6.7.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npwm: Fix out-of-bounds access in of_pwm_single_xlate()\n\nWith args->args_count == 2 args->args[2] is not defined. Actually the\nflags are contained in args->args[1]."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: pwm: corrige el acceso fuera de los l\u00edmites en of_pwm_single_xlate() Con args->args_count == 2 args->args[2] no est\u00e1 definido. En realidad, las banderas est\u00e1n contenidas en args->args[1]."}], "id": "CVE-2024-26599", "lastModified": "2024-11-21T09:02:37.853", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-02-23T15:15:09.660", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7b85554c7c2aee91171e038e4d5442ffa130b282"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a297d07b9a1e4fb8cda25a4a2363a507d294b7c9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bae45b7ebb31984b63b13c3519fd724b3ce92123"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e5f2b4b62977fb6c2efcbc5779e0c9dce18215f7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7b85554c7c2aee91171e038e4d5442ffa130b282"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a297d07b9a1e4fb8cda25a4a2363a507d294b7c9"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bae45b7ebb31984b63b13c3519fd724b3ce92123"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e5f2b4b62977fb6c2efcbc5779e0c9dce18215f7"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: pwm: Fix out-of-bounds access in of_pwm_single_xlate()", "id": "2265802", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2265802"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\npwm: Fix out-of-bounds access in of_pwm_single_xlate()\nWith args->args_count == 2 args->args[2] is not defined. Actually the\nflags are contained in args->args[1].", "A flaw was found in the Linux kernel due to an out-of-bounds access issue in the of_pwm_single_xlate() function within the drivers/pwm/core.c file. This issue occurs because of incorrect indexing of arguments (args->args[2]) when args->args_count == 2, leading to potential memory corruption."], "mitigation": {"lang": "en:us", "value": "No mitigation is currently available for this vulnerability. Make sure to perform the updates as they become available."}, "name": "CVE-2024-26599", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-02-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-26599\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-26599\nhttps://lore.kernel.org/linux-cve-announce/2024022338-CVE-2024-26599-cd65@gregkh/T/#u"], "statement": "The CVE-2024-26599 vulnerability in the Linux kernel is assessed as a Moderate severity due to its potential impact on system stability and security. The issue stems from an out-of-bounds access in the of_pwm_single_xlate() function within drivers/pwm/core.c. When args->args_count == 2, accessing args->args[2] improperly attempts to retrieve data beyond the allocated memory space, leading to memory corruption. While exploitation requires specific conditions and knowledge of system configuration, successful attacks could result in denial of service or unauthorized data exposure.", "threat_severity": "Moderate", "upstream_fix": "kernel 6.8-rc1"}