Linux Kernel up to 6.6.32/6.9.3 tpm_tis_spi out-of-bounds

Summaryinfo

A vulnerability labeled as problematic has been found in Linux Kernel up to 6.6.32/6.9.3. Affected is an unknown function of the component tpm_tis_spi. Executing a manipulation can lead to out-of-bounds. This vulnerability is handled as CVE-2024-36477. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in Linux Kernel up to 6.6.32/6.9.3 and classified as problematic. This vulnerability affects an unknown part of the component tpm_tis_spi. The manipulation with an unknown input leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer The TPM SPI transfer mechanism uses MAX_SPI_FRAMESIZE for computing the maximum transfer length and the size of the transfer buffer. As such, it does not account for the 4 bytes of header that prepends the SPI data frame. This can result in out-of-bounds accesses and was confirmed with KASAN. Introduce SPI_HDRSIZE to account for the header and use to allocate the transfer buffer.

The advisory is shared for download at git.kernel.org. This vulnerability was named CVE-2024-36477. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 215917 (Azure Linux 3.0 Security Update: kernel (CVE-2024-36477)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.6.33 or 6.9.4 eliminates this vulnerability. Applying the patch 1547183852dc/de13c56f9947/195aba96b854 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (215917). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.6.0
• 6.6.1
• 6.6.2
• 6.6.3
• 6.6.4
• 6.6.5
• 6.6.6
• 6.6.7
• 6.6.8
• 6.6.9
• 6.6.10
• 6.6.11
• 6.6.12
• 6.6.13
• 6.6.14
• 6.6.15
• 6.6.16
• 6.6.17
• 6.6.18
• 6.6.19
• 6.6.20
• 6.6.21
• 6.6.22
• 6.6.23
• 6.6.24
• 6.6.25
• 6.6.26
• 6.6.27
• 6.6.28
• 6.6.29
• 6.6.30
• 6.6.31
• 6.6.32
• 6.9.0
• 6.9.1
• 6.9.2
• 6.9.3

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion