{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-35994","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-05-17T13:50:33.147Z","datePublished":"2024-05-20T09:47:58.396Z","dateUpdated":"2026-08-05T11:31:28.204Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:31:28.204Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: qcom: uefisecapp: Fix memory related IO errors and crashes\n\nIt turns out that while the QSEECOM APP_SEND command has specific fields\nfor request and response buffers, uefisecapp expects them both to be in\na single memory region. Failure to adhere to this has (so far) resulted\nin either no response being written to the response buffer (causing an\nEIO to be emitted down the line), the SCM call to fail with EINVAL\n(i.e., directly from TZ/firmware), or the device to be hard-reset.\n\nWhile this issue can be triggered deterministically, in the current form\nit seems to happen rather sporadically (which is why it has gone\nunnoticed during earlier testing). This is likely due to the two\nkzalloc() calls (for request and response) being directly after each\nother. Which means that those likely return consecutive regions most of\nthe time, especially when not much else is going on in the system.\n\nFix this by allocating a single memory region for both request and\nresponse buffers, properly aligning both structs inside it. This\nunfortunately also means that the qcom_scm_qseecom_app_send() interface\nneeds to be restructured, as it should no longer map the DMA regions\nseparately. Therefore, move the responsibility of DMA allocation (or\nmapping) to the caller."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached through the local efivarfs filesystem (`read()` on /sys/firmware/efi/efivars/*), which drives the qcuefi efivar operations; there is no network or remote path to uefisecapp.\nAC:L - The commit states the issue \"can be triggered deterministically\" — it merely looks sporadic because idle-system slab behaviour happens to place the two kzalloc()s adjacently, and an attacker fully controls slab layout via concurrent allocation pressure, parallel readers, and choice of which variable (hence which kmalloc bucket) to read.\nPR:L - efivarfs contains no capable()/CAP_* checks whatsoever and creates variable files mode 0644 under a 0755 directory, so any local unprivileged user can read an EFI variable and drive the buggy request/response allocation pair twice per read().\nUI:N - The attacker triggers the path entirely from their own process by reading efivarfs files; no action by any other user or administrator is needed.\nS:U - The corruption and the reset both land on the same device under the kernel's own security authority; although the secure world is involved, this is scored as standard kernel-local impact rather than a VM/IOMMU boundary escape.\nC:H - When the buffers are non-contiguous the secure world reads and writes normal-world memory outside the regions the kernel allocated and mapped for it, giving out-of-bounds access to adjacent kernel slab objects that can be groomed and leveraged for kernel memory disclosure.\nI:H - The documented failure mode where \"no response [is] written to the response buffer\" means uefisecapp wrote the response into kernel memory outside the allocated response buffer — an out-of-bounds write by a higher-privileged agent into an attacker-groomable slab neighbour, which is exploitable for kernel memory corruption.\nA:H - The commit explicitly documents that the mismatch can cause \"the device to be hard-reset\", a full SoC reset, and the SCM/EIO failures also render the EFI variable interface unusable."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/firmware/qcom/qcom_qseecom_uefisecapp.c","drivers/firmware/qcom/qcom_scm.c","include/linux/firmware/qcom/qcom_qseecom.h","include/linux/firmware/qcom/qcom_scm.h"],"versions":[{"version":"759e7a2b62eb3ef3c93ffeb5cca788a09627d7d9","lessThan":"dd22b34fb53cb04b13b2f5eee5c9200bb091fc88","status":"affected","versionType":"git"},{"version":"759e7a2b62eb3ef3c93ffeb5cca788a09627d7d9","lessThan":"ed09f81eeaa8f9265e1787282cb283f10285c259","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/firmware/qcom/qcom_qseecom_uefisecapp.c","drivers/firmware/qcom/qcom_scm.c","include/linux/firmware/qcom/qcom_qseecom.h","include/linux/firmware/qcom/qcom_scm.h"],"versions":[{"version":"6.7","status":"affected"},{"version":"0","lessThan":"6.7","status":"unaffected","versionType":"semver"},{"version":"6.8.9","lessThanOrEqual":"6.8.*","status":"unaffected","versionType":"semver"},{"version":"6.9","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.8.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.9"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/dd22b34fb53cb04b13b2f5eee5c9200bb091fc88"},{"url":"https://git.kernel.org/stable/c/ed09f81eeaa8f9265e1787282cb283f10285c259"}],"title":"firmware: qcom: uefisecapp: Fix memory related IO errors and crashes","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-35994","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-05-20T14:05:44.255812Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-06-04T17:33:52.169Z"}},{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T03:30:11.569Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/dd22b34fb53cb04b13b2f5eee5c9200bb091fc88","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/ed09f81eeaa8f9265e1787282cb283f10285c259","tags":["x_transferred"]}]}]}}