CVE-2024-38569CWE-129

CVE-2024-38569

High · published June 19, 2024

CVSS v3.1
7.8
EPSS
0%
Percentile
13.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group

The perf tool allows users to create event groups through following

cmd [1], but the driver does not check whether the array index is out of

bounds when writing data to the event_group array. If the number of events

in an event_group is greater than HISI_PCIE_MAX_COUNTERS, the memory write

overflow of event_group array occurs.

Add array index check to fix the possible array out of bounds violation,

and return directly when write new events are written to array bounds.

There are 9 different events in an event_group.

[1] perf stat -e '{pmu/event1/, ... ,pmu/event9/}'

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00234 · 13.5th percentile
Weakness
CWE-129 · Improper Validation of Array Index
Published
2024-06-19T18:15Z
Affected products (4)
ProductVersionsFixed in
linux/linux_kernel≥ 5.17, < 6.1.936.1.93
linux/linux_kernel≥ 6.2, < 6.6.336.6.33
linux/linux_kernel≥ 6.7, < 6.8.126.8.12
linux/linux_kernel≥ 6.9, < 6.9.36.9.3
References (10)
EPSS history
Timeline
  • 19 JUN 13:35Z
    drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group
    cvelistv5