{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-36898", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-30T15:25:07.066Z", "datePublished": "2024-05-30T15:29:02.011Z", "dateUpdated": "2026-08-05T11:31:54.352Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:31:54.352Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpiolib: cdev: fix uninitialised kfifo\n\nIf a line is requested with debounce, and that results in debouncing\nin software, and the line is subsequently reconfigured to enable edge\ndetection then the allocation of the kfifo to contain edge events is\noverlooked. This results in events being written to and read from an\nuninitialised kfifo. Read events are returned to userspace.\n\nInitialise the kfifo in the case where the software debounce is\nalready active." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - Exploitation requires opening the /dev/gpiochipN character device and issuing GPIO_V2_GET_LINE_IOCTL / GPIO_V2_LINE_SET_CONFIG_IOCTL plus read(), all local syscall interfaces. There is no remote or adjacent-network path into gpiolib-cdev.\nAC:L - The trigger is a deterministic, race-free ioctl sequence, and the attacker can generate the required edges themselves by flipping BIAS_PULL_UP/PULL_DOWN via SET_CONFIG or driving a loopback line. Software debouncing (gpiod_set_debounce returning -ENOTSUPP) and CONFIG_GPIO_CDEV are the default on essentially all GPIO controllers and embedded kernels.\nPR:L - No capability check exists anywhere along gpio_chrdev_open → gpio_ioctl → linereq_create → linereq_set_config → linereq_read; access is governed solely by file permissions on /dev/gpiochipN, typically root:gpio 0660. An unprivileged local user in the gpio group — the standard configuration on embedded, industrial, and single-board Linux systems whose applications drive GPIO from userspace — is sufficient.\nUI:N - The attacker performs every step unaided, including generating the GPIO edges via bias reconfiguration or a driven loopback line. No victim action is required at any point.\nS:U - The uninitialized kfifo, the leaked stack data, and the NULL dereference are all confined to the kernel's own security authority on the same host. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - Every read() returns 48 bytes of uninitialized kernel stack from linereq_read's own frame directly to userspace, repeatable without limit, and the attacker can groom that stack region with preceding syscalls to steer what is disclosed. This yields kernel pointers, stack canaries, and residual syscall data — a KASLR/canary bypass and a broad kernel memory disclosure primitive.\nI:N - With esize=0 the kfifo write path copies zero bytes, and data is always NULL whenever mask is 0, so no kernel memory is modified. The bug produces disclosure and a fault, not a write primitive into valid kernel memory.\nA:H - Because the buggy branch commits edflags while leaving the fifo unallocated, an attacker supplying event_buffer_size=1 across two lines reaches kfifo_copy_in() with esize=48, mask=0, data=NULL, causing memcpy() to a NULL destination in workqueue context — a kernel oops. Any such crash is scored High." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpio/gpiolib-cdev.c" ], "versions": [ { "version": "65cff70464068a823b3f4a28074000febdce0630", "lessThan": "c87cc32bc48b187067e089b15ab7a6a7eed5767d", "status": "affected", "versionType": "git" }, { "version": "65cff70464068a823b3f4a28074000febdce0630", "lessThan": "1a51e24404d77bb3307c1e39eee0d8e86febb1a5", "status": "affected", "versionType": "git" }, { "version": "65cff70464068a823b3f4a28074000febdce0630", "lessThan": "883e4bbf06eb5fb7482679e4edb201093e9f55a2", "status": "affected", "versionType": "git" }, { "version": "65cff70464068a823b3f4a28074000febdce0630", "lessThan": "bd7139a70ee8d8ea872b223e043730cf6f5e2b0e", "status": "affected", "versionType": "git" }, { "version": "65cff70464068a823b3f4a28074000febdce0630", "lessThan": "ee0166b637a5e376118e9659e5b4148080f1d27e", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpio/gpiolib-cdev.c" ], "versions": [ { "version": "5.10", "status": "affected" }, { "version": "0", "lessThan": "5.10", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.203", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.91", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.31", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.8.10", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "5.15.203" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.1.91" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.6.31" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.8.10" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.9" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/c87cc32bc48b187067e089b15ab7a6a7eed5767d" }, { "url": "https://git.kernel.org/stable/c/1a51e24404d77bb3307c1e39eee0d8e86febb1a5" }, { "url": "https://git.kernel.org/stable/c/883e4bbf06eb5fb7482679e4edb201093e9f55a2" }, { "url": "https://git.kernel.org/stable/c/bd7139a70ee8d8ea872b223e043730cf6f5e2b0e" }, { "url": "https://git.kernel.org/stable/c/ee0166b637a5e376118e9659e5b4148080f1d27e" } ], "title": "gpiolib: cdev: fix uninitialised kfifo", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2024-06-10T18:49:07.029417Z", "id": "CVE-2024-36898", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-10T18:49:15.269Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:43:50.051Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/1a51e24404d77bb3307c1e39eee0d8e86febb1a5", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/883e4bbf06eb5fb7482679e4edb201093e9f55a2", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/bd7139a70ee8d8ea872b223e043730cf6f5e2b0e", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/ee0166b637a5e376118e9659e5b4148080f1d27e", "tags": [ "x_transferred" ] } ] } ] } }