cve-2024-35996
Vulnerability from cvelistv5
Published
2024-05-20 09:47
Modified
2024-11-05 09:26
Severity ?
Summary
cpu: Re-enable CPU mitigations by default for !X86 architectures
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/36b32816fbab267611f073223f1b0b816ec5920f
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/38f17d1fbb5bfb56ca1419e2d06376d57a9396f9
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8292f4f8dd1b005d0688d726261004f816ef730a
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/af6d6a923b40bf6471e44067ac61cc5814b48e7f
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/fd8547ebc187037cc69441a15c1441aeaab80f49
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/fe42754b94a42d08cf9501790afc25c4f6a5f631
Impacted products
Vendor Product Version
Linux Linux Version: 5.15.156   ≤
Version: 6.1.87   ≤
Version: 6.6.28   ≤
Version: 6.8.7   ≤
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35996",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-17T17:38:11.111508Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-17T17:40:17.312Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:30:12.399Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/af6d6a923b40bf6471e44067ac61cc5814b48e7f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/36b32816fbab267611f073223f1b0b816ec5920f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/38f17d1fbb5bfb56ca1419e2d06376d57a9396f9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8292f4f8dd1b005d0688d726261004f816ef730a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/fd8547ebc187037cc69441a15c1441aeaab80f49"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/fe42754b94a42d08cf9501790afc25c4f6a5f631"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/Kconfig",
            "arch/x86/Kconfig",
            "kernel/cpu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "af6d6a923b40",
              "status": "affected",
              "version": "30da4180fd76",
              "versionType": "git"
            },
            {
              "lessThan": "36b32816fbab",
              "status": "affected",
              "version": "70688450ddda",
              "versionType": "git"
            },
            {
              "lessThan": "38f17d1fbb5b",
              "status": "affected",
              "version": "9c09773917fb",
              "versionType": "git"
            },
            {
              "lessThan": "8292f4f8dd1b",
              "status": "affected",
              "version": "2978ee7c973c",
              "versionType": "git"
            },
            {
              "lessThan": "fd8547ebc187",
              "status": "affected",
              "version": "c4a9babdd5d5",
              "versionType": "git"
            },
            {
              "lessThan": "fe42754b94a4",
              "status": "affected",
              "version": "f337a6a21e2f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/Kconfig",
            "arch/x86/Kconfig",
            "kernel/cpu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5.15.158",
              "status": "affected",
              "version": "5.15.156",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.90",
              "status": "affected",
              "version": "6.1.87",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.30",
              "status": "affected",
              "version": "6.6.28",
              "versionType": "semver"
            },
            {
              "lessThan": "6.8.9",
              "status": "affected",
              "version": "6.8.7",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpu: Re-enable CPU mitigations by default for !X86 architectures\n\nRename x86\u0027s to CPU_MITIGATIONS, define it in generic code, and force it\non for all architectures exception x86.  A recent commit to turn\nmitigations off by default if SPECULATION_MITIGATIONS=n kinda sorta\nmissed that \"cpu_mitigations\" is completely generic, whereas\nSPECULATION_MITIGATIONS is x86-specific.\n\nRename x86\u0027s SPECULATIVE_MITIGATIONS instead of keeping both and have it\nselect CPU_MITIGATIONS, as having two configs for the same thing is\nunnecessary and confusing.  This will also allow x86 to use the knob to\nmanage mitigations that aren\u0027t strictly related to speculative\nexecution.\n\nUse another Kconfig to communicate to common code that CPU_MITIGATIONS\nis already defined instead of having x86\u0027s menu depend on the common\nCPU_MITIGATIONS.  This allows keeping a single point of contact for all\nof x86\u0027s mitigations, and it\u0027s not clear that other architectures *want*\nto allow disabling mitigations at compile-time."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-05T09:26:27.501Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/af6d6a923b40bf6471e44067ac61cc5814b48e7f"
        },
        {
          "url": "https://git.kernel.org/stable/c/36b32816fbab267611f073223f1b0b816ec5920f"
        },
        {
          "url": "https://git.kernel.org/stable/c/38f17d1fbb5bfb56ca1419e2d06376d57a9396f9"
        },
        {
          "url": "https://git.kernel.org/stable/c/8292f4f8dd1b005d0688d726261004f816ef730a"
        },
        {
          "url": "https://git.kernel.org/stable/c/fd8547ebc187037cc69441a15c1441aeaab80f49"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe42754b94a42d08cf9501790afc25c4f6a5f631"
        }
      ],
      "title": "cpu: Re-enable CPU mitigations by default for !X86 architectures",
      "x_generator": {
        "engine": "bippy-9e1c9544281a"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35996",
    "datePublished": "2024-05-20T09:47:59.713Z",
    "dateReserved": "2024-05-17T13:50:33.148Z",
    "dateUpdated": "2024-11-05T09:26:27.501Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-35996\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-20T10:15:13.670\",\"lastModified\":\"2024-11-05T10:17:01.853\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncpu: Re-enable CPU mitigations by default for !X86 architectures\\n\\nRename x86\u0027s to CPU_MITIGATIONS, define it in generic code, and force it\\non for all architectures exception x86.  A recent commit to turn\\nmitigations off by default if SPECULATION_MITIGATIONS=n kinda sorta\\nmissed that \\\"cpu_mitigations\\\" is completely generic, whereas\\nSPECULATION_MITIGATIONS is x86-specific.\\n\\nRename x86\u0027s SPECULATIVE_MITIGATIONS instead of keeping both and have it\\nselect CPU_MITIGATIONS, as having two configs for the same thing is\\nunnecessary and confusing.  This will also allow x86 to use the knob to\\nmanage mitigations that aren\u0027t strictly related to speculative\\nexecution.\\n\\nUse another Kconfig to communicate to common code that CPU_MITIGATIONS\\nis already defined instead of having x86\u0027s menu depend on the common\\nCPU_MITIGATIONS.  This allows keeping a single point of contact for all\\nof x86\u0027s mitigations, and it\u0027s not clear that other architectures *want*\\nto allow disabling mitigations at compile-time.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: cpu: vuelva a habilitar las mitigaciones de CPU de forma predeterminada para arquitecturas !X86. Cambie el nombre de x86 a CPU_MITIGATION, def\u00ednalo en c\u00f3digo gen\u00e9rico y fu\u00e9rcelo para todas las arquitecturas con excepci\u00f3n de x86. Una confirmaci\u00f3n reciente para desactivar las mitigaciones de forma predeterminada si SPECULATION_MITIGATION=n pas\u00f3 por alto que \\\"cpu_mitigations\\\" es completamente gen\u00e9rico, mientras que SPECULATION_MITIGATIONS es espec\u00edfico de x86. Cambie el nombre de SPECULATIVE_MITIGATION de x86 en lugar de conservar ambos y haga que seleccione CPU_MITIGATION, ya que tener dos configuraciones para lo mismo es innecesario y confuso. Esto tambi\u00e9n permitir\u00e1 que x86 use la perilla para administrar mitigaciones que no est\u00e1n estrictamente relacionadas con la ejecuci\u00f3n especulativa. Utilice otro Kconfig para comunicar al c\u00f3digo com\u00fan que CPU_MITIGACIONES ya est\u00e1 definida en lugar de que el men\u00fa de x86 dependa de CPU_MITIGACIONES comunes. Esto permite mantener un \u00fanico punto de contacto para todas las mitigaciones de x86, y no est\u00e1 claro que otras arquitecturas *quieran* permitir deshabilitar las mitigaciones en tiempo de compilaci\u00f3n.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/36b32816fbab267611f073223f1b0b816ec5920f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/38f17d1fbb5bfb56ca1419e2d06376d57a9396f9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8292f4f8dd1b005d0688d726261004f816ef730a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/af6d6a923b40bf6471e44067ac61cc5814b48e7f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fd8547ebc187037cc69441a15c1441aeaab80f49\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fe42754b94a42d08cf9501790afc25c4f6a5f631\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.