{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-47697", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-09-30T16:00:12.942Z", "datePublished": "2024-10-21T11:53:34.630Z", "dateUpdated": "2026-08-05T11:39:30.431Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:39:30.431Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error\n\nEnsure index in rtl2830_pid_filter does not exceed 31 to prevent\nout-of-bounds access.\n\ndev->filters is a 32-bit value, so set_bit and clear_bit functions should\nonly operate on indices from 0 to 31. If index is 32, it will attempt to\naccess a non-existent 33rd bit, leading to out-of-bounds access.\nChange the boundary check from index > 32 to index >= 32 to resolve this\nissue." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable code is reached only through ioctls (DMX_SET_PES_FILTER/DMX_ADD_PID plus DMX_START) on the local DVB demux device node /dev/dvb/adapterN/demux0. No network or remote-peer data reaches rtl2830_pid_filter().\nAC:L - The attacker drives the path deterministically by adding PID filter feeds via ioctl on an already-attached RTL2831U tuner; there is no race, no memory-layout dependency, and no unpredictable state involved in reaching the boundary check.\nPR:L - No capability check exists on the path — dvb_usb_start_feed() and rtl28xxu_pid_filter() perform no privilege validation — so only permission to open the DVB demux character device (commonly the video group, and world-accessible on many embedded/set-top media appliances) is needed.\nUI:N - Once the tuner device is bound, the attacker triggers the path entirely on their own via ioctls on the demux node; no victim action is required.\nS:U - The out-of-bounds write and any resulting corruption stay within the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - An out-of-bounds bit write past the end of the filters bitmap corrupts adjacent kernel memory in struct rtl2830_dev, and per kernel scoring guidance memory corruption of this kind is treated as leverageable toward information disclosure.\nI:H - This is an out-of-bounds write — set_bit()/clear_bit() operate on bit 32 of a 32-bit filter bitmap, modifying kernel memory outside the intended object field, and the register write also goes past the end of the demodulator's PID register block.\nA:H - Corrupting kernel memory adjacent to the filter bitmap (including the driver's fe_status word on 32-bit builds) and writing an out-of-range demodulator register can leave the driver and device in an inconsistent state leading to a crash or hang." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/media/dvb-frontends/rtl2830.c" ], "versions": [ { "version": "df70ddad81b47c57bcccffc805fbd75f2f1b2dc6", "lessThan": "8ffbe7d07b8e76193b151107878ddc1ccc94deb5", "status": "affected", "versionType": "git" }, { "version": "df70ddad81b47c57bcccffc805fbd75f2f1b2dc6", "lessThan": "883f794c6e498ae24680aead55c16f66b06cfc30", "status": "affected", "versionType": "git" }, { "version": "df70ddad81b47c57bcccffc805fbd75f2f1b2dc6", "lessThan": "badbd736e6649c4e6d7b4ff7e2b9857acfa9ea94", "status": "affected", "versionType": "git" }, { "version": "df70ddad81b47c57bcccffc805fbd75f2f1b2dc6", "lessThan": "86d920d2600c3a48efc2775c1666c1017eec6956", "status": "affected", "versionType": "git" }, { "version": "df70ddad81b47c57bcccffc805fbd75f2f1b2dc6", "lessThan": "3dba83d3c81de1368d15a39f22df7b53e306052f", "status": "affected", "versionType": "git" }, { "version": "df70ddad81b47c57bcccffc805fbd75f2f1b2dc6", "lessThan": "58f31be7dfbc0c84a6497ad51924949cf64b86a2", "status": "affected", "versionType": "git" }, { "version": "df70ddad81b47c57bcccffc805fbd75f2f1b2dc6", "lessThan": "7fd6aae7e53b94f4035b1bfce28b8dfa0d0ae470", "status": "affected", "versionType": "git" }, { "version": "df70ddad81b47c57bcccffc805fbd75f2f1b2dc6", "lessThan": "042b101d7bf70616c4967c286ffa6fcca65babfb", "status": "affected", "versionType": "git" }, { "version": "df70ddad81b47c57bcccffc805fbd75f2f1b2dc6", "lessThan": "46d7ebfe6a75a454a5fa28604f0ef1491f9d8d14", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/media/dvb-frontends/rtl2830.c" ], "versions": [ { "version": "4.0", "status": "affected" }, { "version": "0", "lessThan": "4.0", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.323", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.285", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.227", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.168", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.113", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.54", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.13", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.2", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "4.19.323" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "5.4.285" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "5.10.227" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "5.15.168" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "6.1.113" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "6.6.54" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "6.10.13" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "6.11.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "6.12" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/8ffbe7d07b8e76193b151107878ddc1ccc94deb5" }, { "url": "https://git.kernel.org/stable/c/883f794c6e498ae24680aead55c16f66b06cfc30" }, { "url": "https://git.kernel.org/stable/c/badbd736e6649c4e6d7b4ff7e2b9857acfa9ea94" }, { "url": "https://git.kernel.org/stable/c/86d920d2600c3a48efc2775c1666c1017eec6956" }, { "url": "https://git.kernel.org/stable/c/3dba83d3c81de1368d15a39f22df7b53e306052f" }, { "url": "https://git.kernel.org/stable/c/58f31be7dfbc0c84a6497ad51924949cf64b86a2" }, { "url": "https://git.kernel.org/stable/c/7fd6aae7e53b94f4035b1bfce28b8dfa0d0ae470" }, { "url": "https://git.kernel.org/stable/c/042b101d7bf70616c4967c286ffa6fcca65babfb" }, { "url": "https://git.kernel.org/stable/c/46d7ebfe6a75a454a5fa28604f0ef1491f9d8d14" } ], "title": "drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-47697", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-10-21T13:05:04.931797Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-21T13:14:14.204Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:21:02.896Z" } }, { "x_adpType": "supplier", "providerMetadata": { "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-05-12T11:58:15.755Z" }, "affected": [ { "vendor": "Siemens", "product": "RUGGEDCOM RST2428P", "versions": [ { "status": "unaffected", "version": "0", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family", "versions": [ { "status": "unaffected", "version": "0", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SCALANCE XCM-/XRM-/XCH-/XRH-300 family", "versions": [ { "status": "unaffected", "version": "0", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [ { "status": "affected", "version": "0", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" } ], "references": [ { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-355557.html" } ] } ] } }