Junglewise Threat Intelligence

CVE-2024-35813: Linux Kernel out-of-bounds array access in MMC core

CVE-2024-35813 · Severity: medium · CVSS 5.5 · Published 2024-05-17

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's MultiMediaCard (MMC) subsystem, which handles communication with storage devices like SD cards and eMMC chips. An error in how the system processes certain storage commands could allow a local user to cause a system crash or instability. This issue primarily impacts the availability of the affected system rather than the confidentiality of user data.

Technical details

A vulnerability exists in the Linux kernel MMC core within the `__mmc_blk_ioctl_cmd` function in `drivers/mmc/core/block.c`. The root cause is a missing bounds check on an iterator variable `i` before it is used to access the `idatas` array with a negative offset (`i - 1`). This occurs when processing MMC IOCTL commands with the `MMC_BLK_IOC_SBC` flag set. A local attacker with permissions to issue IOCTLs to MMC block devices could trigger this out-of-bounds access, leading to a kernel oops or system crash. The issue was introduced in commit 4d0c8d0aef63 and has been patched in multiple stable kernel branches.

Affected products

  • Linux Linux Kernel 5.4.269 to 5.4.274, 5.10.210 to 5.10.215, 5.15.149 to 5.15.154, 6.1.76 to 6.1.84, 6.6.15 to 6.6.24, 6.7.3 to 6.7.12, 6.8 to 6.8.3

Timeline

  • 2024-05-17: advisory: Initial publication of CVE-2024-35813
  • 2024-04-03: patched: Fix committed to various stable kernel branches

References