Vulnerability · Published May 17, 2024 · Assigned by Linux
CVE-2024-35837net: mvpp2: clear BM pool before initialization
Medium 5.5
In plain English
A medium-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.2%top 87.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: clear BM pool before initialization Register value persist after booting the kernel using kexec which results in kernel panic. Thus clear the BM pool registers before initialisation to fix the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | linux | 6.1.76-1 | DEBIAN-CVE-2024-35837 |
| Debian:13 | linux | 6.7.7-1 | DEBIAN-CVE-2024-35837 |
| Debian:14 | linux | 6.7.7-1 | DEBIAN-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux | 5.15.0-106.116 | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-allwinner-5.19 | no fix listed | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-aws | 5.15.0-1061.67 | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-aws-5.19 | no fix listed | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-aws-6.2 | no fix listed | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-aws-6.5 | no fix listed | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-azure | 5.15.0-1063.72 | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-azure-5.19 | no fix listed | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-azure-6.2 | no fix listed | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-azure-6.5 | 6.5.0-1022.23~22.04.1 | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-azure-fde | 5.15.0-1063.72.1 | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-azure-fde-5.19 | no fix listed | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-azure-fde-6.2 | no fix listed | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-gcp | 5.15.0-1059.67 | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-gcp-5.19 | no fix listed | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-gcp-6.2 | no fix listed | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-gcp-6.5 | 6.5.0-1022.24~22.04.1 | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-gke | 5.15.0-1058.63 | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-gkeop | 5.15.0-1044.51 | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-hwe-5.19 | no fix listed | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-hwe-6.2 | no fix listed | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-hwe-6.5 | 6.5.0-41.41~22.04.2 | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-ibm | 5.15.0-1054.57 | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-intel-iotg | 5.15.0-1057.63 | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-kvm | 5.15.0-1058.63 | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-lowlatency | 5.15.0-106.116 | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-5.19 | no fix listed | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-6.2 | no fix listed | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-6.5 | 6.5.0-41.41.1~22.04.1 | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-nvidia | 5.15.0-1054.55 | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-nvidia-6.2 | no fix listed | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-nvidia-6.5 | 6.5.0-1021.22 | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-nvidia-tegra | 5.15.0-1026.26 | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-nvidia-tegra-igx | 5.15.0-1015.15 | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-oem-5.17 | no fix listed | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-oem-6.0 | no fix listed | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-oem-6.1 | no fix listed | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-oem-6.5 | 6.5.0-1024.25 | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-oracle | 5.15.0-1059.65 | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-oracle-6.5 | 6.5.0-1024.24~22.04.1 | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-raspi | 5.15.0-1054.57 | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-realtime | no fix listed | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-riscv | no fix listed | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-riscv-5.19 | no fix listed | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-riscv-6.5 | 6.5.0-40.40.1~22.04.1 | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-starfive-5.19 | no fix listed | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-starfive-6.2 | no fix listed | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-starfive-6.5 | 6.5.0-1015.16~22.04.1 | UBUNTU-CVE-2024-35837 |
| Ubuntu:22.04:LTS | linux-xilinx-zynqmp | 5.15.0-1030.34 | UBUNTU-CVE-2024-35837 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | 3f518509dedc99f0b755d2ce68d24f610e3a005a – before 83f99138bf3b396f761600ab488054396fb5768f3f518509dedc99f0b755d2ce68d24f610e3a005a – before af47faa6d3328406038b731794e7cf508c71affa3f518509dedc99f0b755d2ce68d24f610e3a005a – before cec65f09c47d8c2d67f2bcad6cf05c490628d1ec3f518509dedc99f0b755d2ce68d24f610e3a005a – before 938729484cfa535e9987ed0f86f29a2ae3a8188b3f518509dedc99f0b755d2ce68d24f610e3a005a – before dc77f6ab5c3759df60ff87ed24f4d45df0f3b4c43f518509dedc99f0b755d2ce68d24f610e3a005a – before 9f538b415db862e74b8c5d3abbccfc1b2b6caa38 |
| Linux | Linux | 3.17 |
References
- https://git.kernel.org/stable/c/83f99138bf3b396f761600ab488054396fb5768f
- https://git.kernel.org/stable/c/af47faa6d3328406038b731794e7cf508c71affa
- https://git.kernel.org/stable/c/cec65f09c47d8c2d67f2bcad6cf05c490628d1ec
- https://git.kernel.org/stable/c/938729484cfa535e9987ed0f86f29a2ae3a8188b
- https://git.kernel.org/stable/c/dc77f6ab5c3759df60ff87ed24f4d45df0f3b4c4
- https://git.kernel.org/stable/c/9f538b415db862e74b8c5d3abbccfc1b2b6caa38
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html x_transferred