Skip to content
fr Sign in
7.8 High

CVE-2024-36016 In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: fix possible out-of-bounds in…

Description

In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: fix possible out-of-bounds in gsm0_receive() Assuming the following: - side A configures the n_gsm in basic option mode - side B sends the header of a basic option mode frame with data length 1 - side A switches to advanced option mode - side B sends 2 data bytes which exceeds gsm->len Reason: gsm->len is not used in advanced option mode. - side A switches to basic option mode - side B keeps sending until gsm0_receive() writes past gsm->buf Reason: Neither gsm->state nor gsm->len have been reset after reconfiguration. Fix this by changing gsm->count to gsm->len comparison from equal to less than. Also add upper limit checks against the constant MAX_MRU in gsm0_receive() and gsm1_receive() to harden against memory corruption of gsm->len and gsm->mru. All other checks remain as we still need to limit the data according to the user configuration and actual payload size.

Affected products and versions

Product Affected versions Fixed in
Linux 6.10 earliest → < 6.10 6.10
Linux 6.9 earliest → < 6.9.3 6.9.3
Linux 6.8 earliest → < 6.8.12 6.8.12
Linux 6.6 earliest → < 6.6.33 6.6.33
Linux 6.1 earliest → < 6.1.93 6.1.93
Linux 5.15 earliest → < 5.15.161 5.15.161
Linux 5.10 earliest → < 5.10.219 5.10.219
Linux 5.4 earliest → < 5.4.278 5.4.278
Linux 4.19 earliest → < 4.19.316 4.19.316
Show the 15 other branches
Product Affected versions Fixed in
Linux 2.6.35 No fix stated
linux_kernel 9513 earliest → < 9513d4148950 9513d4148950
linux_kernel 774 earliest → < 774d83b008ec 774d83b008ec
linux_kernel 46 earliest → 46f52c89a7e7 No fix stated
linux_kernel 6.10 earliest → < 6.10 6.10
linux_kernel 6.9 earliest → < 6.9.3 6.9.3
linux_kernel 6.8 earliest → < 6.8.12 6.8.12
linux_kernel 6.6 earliest → < 6.6.33 6.6.33
linux_kernel 6.1 earliest → < 6.1.93 6.1.93
linux_kernel 5.15 earliest → < 5.15.161 5.15.161
linux_kernel 5.10 earliest → < 5.10.219 5.10.219
linux_kernel 5.4 earliest → < 5.4.278 5.4.278
linux_kernel 4.19 earliest → < 4.19.316 4.19.316
linux_kernel 4 earliest → < 4c267110fc11 4c267110fc11
linux_kernel 0 earliest → < 0fb736c9931e 0fb736c9931e

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Linux

The 18283 CVEs of Linux →
CVE-2026-99270 In the Linux kernel, the following vulnerability has been resolved: tcp: Fix potential UAF in reqsk_timer_handler() 8.1 High CVE-2026-99269 In the Linux kernel, the following vulnerability has been resolved: sched_ext: Wait for SCX_OPSS_DISPATCHING before… 7.8 High CVE-2026-99261 In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: correct reservation fence slots for… Not rated CVE-2026-99260 In the Linux kernel, the following vulnerability has been resolved: ntfs: fix resident conversion in ntfs_new_attr_flags… Not rated
Track this CVE