CVE-2024-35997 – A race condition in the Linux kernel's I2C-HID ... (How to Fix)

Q: What is the severity of CVE-2024-35997?

CVE-2024-35997 has a CVSS score of 5.5 (MEDIUM). A race condition in the Linux kernel's I2C-HID driver can cause a CPU lock-up when interrupt handling conflicts with I2C operations. This affects systems using I2C-HID devices (like touchpads, keyboards) on vulnerable kernel versions. The vulnerability can lead to denial of service on affected systems.

📋 TL;DR

A race condition in the Linux kernel's I2C-HID driver can cause a CPU lock-up when interrupt handling conflicts with I2C operations. This affects systems using I2C-HID devices (like touchpads, keyboards) on vulnerable kernel versions. The vulnerability can lead to denial of service on affected systems.

💻 Affected Systems

Products:

Linux kernel with I2C-HID driver

Versions: Kernel versions containing the vulnerable code before fixes were backported

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with I2C-HID devices (common in laptops and embedded systems).

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system lock-up requiring hard reboot, potentially causing data loss or service disruption.

🟠

Likely Case

Local denial of service affecting I2C-HID device functionality, possibly requiring reboot.

🟢

If Mitigated

Minimal impact if systems are patched or don't use I2C-HID devices.

🌐 Internet-Facing: LOW - Requires local access to trigger, not remotely exploitable.

🏢 Internal Only: MEDIUM - Local users or processes could trigger lock-up affecting shared systems.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and specific timing conditions to trigger the race condition.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel commits: 0561b65fbd53d3e788c5b0222d9112ca016fd6a1 and related stable backports

Vendor Advisory: https://git.kernel.org/stable/c/0561b65fbd53d3e788c5b0222d9112ca016fd6a1

Restart Required: Yes

Instructions:

1. Update to patched kernel version from your distribution. 2. Reboot system. 3. Verify kernel version after reboot.

🔧 Temporary Workarounds

Disable I2C-HID devices

linux

Remove or blacklist I2C-HID driver to prevent vulnerability trigger

echo 'blacklist i2c_hid' > /etc/modprobe.d/blacklist-i2c-hid.conf
update-initramfs -u
reboot

🧯 If You Can't Patch

Restrict local user access to systems with I2C-HID devices
Monitor system logs for lock-up events and implement rapid response procedures

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if I2C-HID module is loaded: lsmod | grep i2c_hid

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is patched and check dmesg for I2C-HID driver loading without errors

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
CPU stuck messages in dmesg
I2C timeout errors

Network Indicators:

None - local vulnerability only

SIEM Query:

source="kernel" AND ("i2c_hid" OR "CPU stuck" OR "watchdog")

📊 Metadata

CVE ID: CVE-2024-35997

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-667

Published: May 20, 2024

Last Updated: January 16, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-35997, you might also want to check these: