CVE-2024-35848

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-35848
In the Linux kernel, the following vulnerability has been resolved: eeprom: at24: fix memory corruption race condition If the eeprom is not accessible, an nvmem device will be registered, the read will fail, and the device will be torn down. If another driver accesses the nvmem device after the teardown, it will reference invalid memory. Move the failure point before registering the nvmem device.

4.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/26d32bec4c6d255a03762f33c637bfa3718be15a Patch
https://git.kernel.org/stable/c/2af84c46b9b8f2d6c0f88d09ee5c849ae1734676 Patch
https://git.kernel.org/stable/c/6d8b56ec0c8f30d5657382f47344a32569f7a9bc Patch
https://git.kernel.org/stable/c/c43e5028f5a35331eb25017f5ff6cc21735005c6 Patch
https://git.kernel.org/stable/c/c850f71fca09ea41800ed55905980063d17e01da Patch
https://git.kernel.org/stable/c/f42c97027fb75776e2e9358d16bf4a99aeb04cf2 Patch
https://git.kernel.org/stable/c/26d32bec4c6d255a03762f33c637bfa3718be15a Patch
https://git.kernel.org/stable/c/2af84c46b9b8f2d6c0f88d09ee5c849ae1734676 Patch
https://git.kernel.org/stable/c/6d8b56ec0c8f30d5657382f47344a32569f7a9bc Patch
https://git.kernel.org/stable/c/c43e5028f5a35331eb25017f5ff6cc21735005c6 Patch
https://git.kernel.org/stable/c/c850f71fca09ea41800ed55905980063d17e01da Patch
https://git.kernel.org/stable/c/f42c97027fb75776e2e9358d16bf4a99aeb04cf2 Patch
https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
History

23 Dec 2025, 19:33

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/26d32bec4c6d255a03762f33c637bfa3718be15a - () https://git.kernel.org/stable/c/26d32bec4c6d255a03762f33c637bfa3718be15a - Patch
References () https://git.kernel.org/stable/c/2af84c46b9b8f2d6c0f88d09ee5c849ae1734676 - () https://git.kernel.org/stable/c/2af84c46b9b8f2d6c0f88d09ee5c849ae1734676 - Patch
References () https://git.kernel.org/stable/c/6d8b56ec0c8f30d5657382f47344a32569f7a9bc - () https://git.kernel.org/stable/c/6d8b56ec0c8f30d5657382f47344a32569f7a9bc - Patch
References () https://git.kernel.org/stable/c/c43e5028f5a35331eb25017f5ff6cc21735005c6 - () https://git.kernel.org/stable/c/c43e5028f5a35331eb25017f5ff6cc21735005c6 - Patch
References () https://git.kernel.org/stable/c/c850f71fca09ea41800ed55905980063d17e01da - () https://git.kernel.org/stable/c/c850f71fca09ea41800ed55905980063d17e01da - Patch
References () https://git.kernel.org/stable/c/f42c97027fb75776e2e9358d16bf4a99aeb04cf2 - () https://git.kernel.org/stable/c/f42c97027fb75776e2e9358d16bf4a99aeb04cf2 - Patch
References () https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html - () https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html - Third Party Advisory
CWE CWE-362
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.7
CPE cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
First Time Linux
Debian
Debian debian Linux
Linux linux Kernel

21 Nov 2024, 09:21

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html -
References () https://git.kernel.org/stable/c/26d32bec4c6d255a03762f33c637bfa3718be15a - () https://git.kernel.org/stable/c/26d32bec4c6d255a03762f33c637bfa3718be15a -
References () https://git.kernel.org/stable/c/2af84c46b9b8f2d6c0f88d09ee5c849ae1734676 - () https://git.kernel.org/stable/c/2af84c46b9b8f2d6c0f88d09ee5c849ae1734676 -
References () https://git.kernel.org/stable/c/6d8b56ec0c8f30d5657382f47344a32569f7a9bc - () https://git.kernel.org/stable/c/6d8b56ec0c8f30d5657382f47344a32569f7a9bc -
References () https://git.kernel.org/stable/c/c43e5028f5a35331eb25017f5ff6cc21735005c6 - () https://git.kernel.org/stable/c/c43e5028f5a35331eb25017f5ff6cc21735005c6 -
References () https://git.kernel.org/stable/c/c850f71fca09ea41800ed55905980063d17e01da - () https://git.kernel.org/stable/c/c850f71fca09ea41800ed55905980063d17e01da -
References () https://git.kernel.org/stable/c/f42c97027fb75776e2e9358d16bf4a99aeb04cf2 - () https://git.kernel.org/stable/c/f42c97027fb75776e2e9358d16bf4a99aeb04cf2 -

05 Nov 2024, 10:16

Type Values Removed Values Added
References
  • {'url': 'https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}

27 Jun 2024, 14:15

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: eeprom: at24: corrige la condición de ejecución por corrupción de memoria. Si no se puede acceder a la eeprom, se registrará un dispositivo nvmem, la lectura fallará y el dispositivo se apagará. Si otro controlador accede al dispositivo nvmem después del desmontaje, hará referencia a una memoria no válida. Mueva el punto de fallo antes de registrar el dispositivo nvmem.
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html -

17 May 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-17 15:15

Updated : 2025-12-23 19:33

NVD link : CVE-2024-35848

Mitre link : CVE-2024-35848

CVE.ORG link : CVE-2024-35848

JSON object : View

Products Affected

debian

  • debian_linux

linux

  • linux_kernel
CWE
CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')