CVE-2024-35823

Q: What is the severity of CVE-2024-35823?

CVE-2024-35823 has a CVSS score of 5.3 (MEDIUM). This CVE describes a buffer corruption vulnerability in the Linux kernel's virtual terminal (vt) subsystem when deleting Unicode characters. The issue occurs due to improper use of memcpy() with overlapping buffers, which can lead to memory corruption. This affects all Linux systems using virtual terminals with Unicode support.

5.3 MEDIUM

Buffer Overflow

📋 TL;DR

This CVE describes a buffer corruption vulnerability in the Linux kernel's virtual terminal (vt) subsystem when deleting Unicode characters. The issue occurs due to improper use of memcpy() with overlapping buffers, which can lead to memory corruption. This affects all Linux systems using virtual terminals with Unicode support.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not explicitly stated in CVE, but references indicate stable kernel commits from 2024.

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires virtual terminal usage with Unicode characters. Systems without terminal access or Unicode support may not be affected.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic or system crash leading to denial of service, or potential privilege escalation if an attacker can control the corrupted memory region.

🟠

Likely Case

System instability, terminal corruption, or kernel crash when specific Unicode character deletion operations are performed.

🟢

If Mitigated

Minimal impact if systems don't use virtual terminals extensively or have restricted terminal access.

🌐 Internet-Facing: LOW - Requires local terminal access or specific terminal manipulation.

🏢 Internal Only: MEDIUM - Local users or processes with terminal access could trigger the vulnerability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and ability to manipulate terminal Unicode characters. No public exploits known at this time.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits: 0190d19d7651c08abc187dac3819c61b726e7e3f, 1581dafaf0d34bc9c428a794a22110d7046d186d, 1ce408f75ccf1e25b3fddef75cca878b55f2ac90, 2933b1e4757a0a5c689cf48d80b1a2a85f237ff1, 7529cbd8b5f6697b369803fe1533612c039cabda

Vendor Advisory: https://git.kernel.org/stable/c/

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution's repositories. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.

🔧 Temporary Workarounds

Disable Unicode terminal support

linux

Prevent Unicode character handling in virtual terminals to avoid triggering the vulnerability

echo 0 > /proc/sys/kernel/printk_unicode
set LANG=C in terminal sessions

Restrict terminal access

linux

Limit who can access virtual terminals on the system

chmod 600 /dev/tty*
remove unnecessary users from tty group

🧯 If You Can't Patch

Restrict access to virtual terminals to trusted users only
Monitor system logs for kernel panic or terminal corruption events

🔍 How to Verify

Check if Vulnerable:

Check kernel version and compare with patched commits. Vulnerable if using kernel without the fix commits.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes the fix commits: uname -r and check git log for commit hashes

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
Terminal corruption errors
System crash/reboot events

Network Indicators:

None - local vulnerability only

SIEM Query:

source="kernel" AND ("panic" OR "Oops" OR "corruption") AND process="vt"

📊 Metadata

CVE ID: CVE-2024-35823

CVSS v3 Score: 5.3 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE: CWE-120

Published: May 17, 2024

Last Updated: April 7, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable Unicode terminal support

Restrict terminal access

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities