Login Sign Up

CVE-2024-35813

5.5 MEDIUM
Denial of Service

📋 TL;DR

This CVE addresses an out-of-bounds array access vulnerability in the Linux kernel's MMC (MultiMediaCard) subsystem. The flaw occurs when accessing an array with a negative index during close-ended firmware update operations, potentially leading to kernel memory corruption. This affects all Linux systems using the vulnerable kernel version with MMC/SD card functionality.

💻 Affected Systems

Products:
  • Linux kernel
Versions: Specific affected kernel versions not specified in CVE description, but patches are available in stable branches
Operating Systems: Linux distributions using vulnerable kernel versions
Default Config Vulnerable: ⚠️ Yes
Notes: Vulnerability is in the MMC core subsystem and requires MMC/SD card functionality to be present and used.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic or system crash due to invalid memory access, potentially leading to denial of service or local privilege escalation if combined with other vulnerabilities.

🟠

Likely Case

System instability or crash when performing MMC/SD card firmware update operations, resulting in denial of service.

🟢

If Mitigated

Minimal impact if MMC/SD card firmware updates are not performed or if the vulnerable code path is not triggered.

🌐 Internet-Facing: LOW - This is a local kernel vulnerability requiring local access to trigger.
🏢 Internal Only: MEDIUM - Local users or processes with MMC/SD card access could potentially trigger the vulnerability.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ✅ No
Complexity: MEDIUM

Exploitation requires local access and triggering of the specific MMC firmware update code path. No public exploits are known at this time.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Multiple stable kernel versions with fixes: 064db53f9023a2d5877a2d12de6bc27995f6ca56, 2b539c88940e22494da80a93ee1c5a28bbad10f6, 4466677dcabe2d70de6aa3d4bd4a4fafa94a71f2, 7d0e8a6147550aa058fa6ade8583ad252aa61304, 81b8645feca08a54c7c4bf36e7b176f4983b2f28

Vendor Advisory: https://git.kernel.org/stable/c/064db53f9023a2d5877a2d12de6bc27995f6ca56

Restart Required: Yes

Instructions:

1. Update to a patched kernel version from your Linux distribution's repositories. 2. Reboot the system to load the new kernel. 3. Verify the kernel version after reboot.

🔧 Temporary Workarounds

Disable MMC/SD card firmware updates

linux

Prevent triggering of the vulnerable code path by disabling MMC/SD card firmware update functionality

echo 'blacklist mmc_core' >> /etc/modprobe.d/blacklist.conf
update-initramfs -u

🧯 If You Can't Patch

  • Restrict physical and logical access to MMC/SD card devices
  • Implement strict access controls to prevent unauthorized users from performing MMC operations

🔍 How to Verify

Check if Vulnerable:

Check kernel version and compare with patched versions. Vulnerable if using unpatched kernel with MMC functionality.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version matches patched version and test MMC/SD card firmware update functionality.

📡 Detection & Monitoring

Log Indicators:

  • Kernel panic messages
  • MMC subsystem error messages in dmesg
  • System crash/reboot logs

Network Indicators:

  • No network indicators - local vulnerability only

SIEM Query:

Search for kernel panic events or MMC subsystem errors in system logs

📊 Metadata

CVE ID: CVE-2024-35813
CVSS v3 Score: 5.5 (MEDIUM)
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Published: May 17, 2024
Last Updated: December 16, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON