PT-2024-5398
CVE-2024-36477
·
تاريخ النشر
2024-05-28
·
تاريخ التحديث
2026-08-04
الوصف من
CVSS 3.1
7.8
عاليةالمقاييسAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The issue is related to the TPM SPI transfer mechanism in the Linux kernel, which does not account for the 4 bytes of header that prepends the SPI data frame. This can result in out-of-bounds accesses and was confirmed with KASAN. The introduction of SPI HDRSIZE is intended to account for the header and allocate the transfer buffer correctly.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
قابلية الاستغلال
استغلال
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾