CVE-2024-35827 — Integer Overflow or Wraparound

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.1.85-1 (bookworm)	linux 6.1.85-1 (bookworm)
linux	linux	—	—
linux	linux	>= 9b0fc3c054ff2eb13753104884f1045b5bb3a627 < 868ec868616438df487b9e2baa5a99f8662cc47c	868ec868616438df487b9e2baa5a99f8662cc47c
linux	linux	>= 9b0fc3c054ff2eb13753104884f1045b5bb3a627 < 59a534690ecc3af72c6ab121aeac1237a4adae66	59a534690ecc3af72c6ab121aeac1237a4adae66
linux	linux	>= 9b0fc3c054ff2eb13753104884f1045b5bb3a627 < 0c8c74bb59e7d77554016efc34c2d10376985e5e	0c8c74bb59e7d77554016efc34c2d10376985e5e
linux	linux	>= 9b0fc3c054ff2eb13753104884f1045b5bb3a627 < b6563ad0d599110bd5cf8f56c47d279c3ed796fe	b6563ad0d599110bd5cf8f56c47d279c3ed796fe
linux	linux	>= 9b0fc3c054ff2eb13753104884f1045b5bb3a627 < 8ede3db5061bb1fe28e2c9683329aafa89d2b1b4	8ede3db5061bb1fe28e2c9683329aafa89d2b1b4
linux	linux_kernel	>= 0 < 6.1.85-1	6.1.85-1
linux	linux_kernel	>= 0 < 6.7.12-1	6.7.12-1
linux	linux_kernel	>= 0 < 6.7.12-1	6.7.12-1
linux	linux_kernel	>= 0 < 6.8.0-35.35	6.8.0-35.35
linux	linux_kernel	>= 6.0 < 6.1.83	6.1.83
linux	linux_kernel	>= 6.2 < 6.6.23	6.6.23
linux	linux_kernel	>= 6.7 < 6.7.11	6.7.11
linux	linux_kernel	>= 6.8 < 6.8.2	6.8.2
msrc	azl3_hyperv-daemons_6.6.22.1-2_on_azure_linux_3.0	—	—
msrc	azl3_hyperv-daemons_6.6.35.1-1_on_azure_linux_3.0	—	—
msrc	azure_linux_3.0_arm	—	—
msrc	azure_linux_3.0_x64	—	—

Ubuntu

Linux kernel (Oracle) vulnerabilities

vendor_ubuntu·2024-07-04·CVSS 6.3

CVE-2024-26868 [MEDIUM] Linux kernel (Oracle) vulnerabilities Title: Linux kernel (Oracle) vulnerabilities Summary: Several security issues were fixed in the Linux kernel. Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not properly handle certain error conditions, leading to a NULL pointer dereference. A local attacker could possibly trigger this vulnerability to cause a denial of service. (CVE-2022-38096) Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-47233) It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-fre

Ubuntu

Linux kernel vulnerabilities

vendor_ubuntu·2024-06-14·CVSS 6.3

CVE-2024-26978 [MEDIUM] Linux kernel vulnerabilities Title: Linux kernel vulnerabilities Summary: Several security issues were fixed in the Linux kernel. Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not properly handle certain error conditions, leading to a NULL pointer dereference. A local attacker could possibly trigger this vulnerability to cause a denial of service. (CVE-2022-38096) Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-47233) It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnera

Ubuntu

Linux kernel (OEM) vulnerabilities

vendor_ubuntu·2024-06-11·CVSS 6.3

CVE-2024-27033 [MEDIUM] Linux kernel (OEM) vulnerabilities Title: Linux kernel (OEM) vulnerabilities Summary: Several security issues were fixed in the Linux kernel. Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not properly handle certain error conditions, leading to a NULL pointer dereference. A local attacker could possibly trigger this vulnerability to cause a denial of service. (CVE-2022-38096) Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-47233) It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free v

Ubuntu

Linux kernel vulnerabilities

vendor_ubuntu·2024-06-07·CVSS 6.3

CVE-2024-26876 [MEDIUM] Linux kernel vulnerabilities Title: Linux kernel vulnerabilities Summary: Several security issues were fixed in the Linux kernel. Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not properly handle certain error conditions, leading to a NULL pointer dereference. A local attacker could possibly trigger this vulnerability to cause a denial of service. (CVE-2022-38096) Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-47233) It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnera

Ubuntu

Linux kernel vulnerabilities

vendor_ubuntu·2024-06-07·CVSS 6.3

CVE-2024-26870 [MEDIUM] Linux kernel vulnerabilities Title: Linux kernel vulnerabilities Summary: Several security issues were fixed in the Linux kernel. Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not properly handle certain error conditions, leading to a NULL pointer dereference. A local attacker could possibly trigger this vulnerability to cause a denial of service. (CVE-2022-38096) Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-47233) It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnera

Red Hat

kernel: io_uring/net: fix overflow check in io_recvmsg_mshot_prep()

vendor_redhat·2024-05-17·CVSS 5.5

CVE-2024-35827 [MEDIUM] kernel: io_uring/net: fix overflow check in io_recvmsg_mshot_prep() kernel: io_uring/net: fix overflow check in io_recvmsg_mshot_prep() In the Linux kernel, the following vulnerability has been resolved: io_uring/net: fix overflow check in io_recvmsg_mshot_prep() The "controllen" variable is type size_t (unsigned long). Casting it to int could lead to an integer underflow. The check_add_overflow() function considers the type of the destination which is type int. If we add two positive values and the result cannot fit in an integer then that's counted as an overflow. However, if we cast "controllen" to an int and it turns negative, then negative values *can* fit into an int type so there is no overflow. Good: 100 + (unsigned long)-4 = 96 <-- overflow Bad: 100 + (int)-4 = 96 <-- no overflow I deleted the cast of the sizeof() as well. That's not a bug but th

Microsoft

io_uring/net: fix overflow check in io_recvmsg_mshot_prep()

vendor_msrc·2024-05-14·CVSS 5.5

CVE-2024-35827 [MEDIUM] CWE-190 io_uring/net: fix overflow check in io_recvmsg_mshot_prep() io_uring/net: fix overflow check in io_recvmsg_mshot_prep() FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this. Mariner: Mariner Linux: Linux Customer Action Required: Yes Remediation: CBL-Mariner Releases Reference: https://l

Debian

CVE-2024-35827: linux - In the Linux kernel, the following vulnerability has been resolved: io_uring/ne...

vendor_debian·2024·CVSS 5.5

CVE-2024-35827 [MEDIUM] CVE-2024-35827: linux - In the Linux kernel, the following vulnerability has been resolved: io_uring/ne... In the Linux kernel, the following vulnerability has been resolved: io_uring/net: fix overflow check in io_recvmsg_mshot_prep() The "controllen" variable is type size_t (unsigned long). Casting it to int could lead to an integer underflow. The check_add_overflow() function considers the type of the destination which is type int. If we add two positive values and the result cannot fit in an integer then that's counted as an overflow. However, if we cast "controllen" to an int and it turns negative, then negative values *can* fit into an int type so there is no overflow. Good: 100 + (unsigned long)-4 = 96 <-- overflow Bad: 100 + (int)-4 = 96 <-- no overflow I deleted the cast of the sizeof() as well. That's not a bug but the cast is unnecessary. Scope: local bookworm: resolved (fixed in 6.1.

OSV

linux-oracle vulnerabilities

osv·2024-07-04·CVSS 5.5

CVE-2022-38096 [MEDIUM] linux-oracle vulnerabilities linux-oracle vulnerabilities Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not properly handle certain error conditions, leading to a NULL pointer dereference. A local attacker could possibly trigger this vulnerability to cause a denial of service. (CVE-2022-38096) Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-47233) It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possib

OSV

linux-azure, linux-gke vulnerabilities

osv·2024-06-14·CVSS 5.5

CVE-2022-38096 [MEDIUM] linux-azure, linux-gke vulnerabilities linux-azure, linux-gke vulnerabilities Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not properly handle certain error conditions, leading to a NULL pointer dereference. A local attacker could possibly trigger this vulnerability to cause a denial of service. (CVE-2022-38096) Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-47233) It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service

OSV

linux-oem-6.8 vulnerabilities

osv·2024-06-11·CVSS 5.5

CVE-2022-38096 [MEDIUM] linux-oem-6.8 vulnerabilities linux-oem-6.8 vulnerabilities Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not properly handle certain error conditions, leading to a NULL pointer dereference. A local attacker could possibly trigger this vulnerability to cause a denial of service. (CVE-2022-38096) Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-47233) It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possi

OSV

linux, linux-ibm, linux-lowlatency, linux-raspi vulnerabilities

osv·2024-06-07·CVSS 5.5

CVE-2022-38096 [MEDIUM] linux, linux-ibm, linux-lowlatency, linux-raspi vulnerabilities linux, linux-ibm, linux-lowlatency, linux-raspi vulnerabilities Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not properly handle certain error conditions, leading to a NULL pointer dereference. A local attacker could possibly trigger this vulnerability to cause a denial of service. (CVE-2022-38096) Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-47233) It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to

OSV

linux-aws, linux-gcp vulnerabilities

osv·2024-06-07·CVSS 5.5

CVE-2022-38096 [MEDIUM] linux-aws, linux-gcp vulnerabilities linux-aws, linux-gcp vulnerabilities Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not properly handle certain error conditions, leading to a NULL pointer dereference. A local attacker could possibly trigger this vulnerability to cause a denial of service. (CVE-2022-38096) Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-47233) It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service o

OSV

CVE-2024-35827: In the Linux kernel, the following vulnerability has been resolved: io_uring/net: fix overflow check in io_recvmsg_mshot_prep() The "controllen" varia

osv·2024-05-17·CVSS 5.5

CVE-2024-35827 [MEDIUM] CVE-2024-35827: In the Linux kernel, the following vulnerability has been resolved: io_uring/net: fix overflow check in io_recvmsg_mshot_prep() The "controllen" varia In the Linux kernel, the following vulnerability has been resolved: io_uring/net: fix overflow check in io_recvmsg_mshot_prep() The "controllen" variable is type size_t (unsigned long). Casting it to int could lead to an integer underflow. The check_add_overflow() function considers the type of the destination which is type int. If we add two positive values and the result cannot fit in an integer then that's counted as an overflow. However, if we cast "controllen" to an int and it turns negative, then negative values *can* fit into an int type so there is no overflow. Good: 100 + (unsigned long)-4 = 96 <-- overflow Bad: 100 + (int)-4 = 96 <-- no overflow I deleted the cast of the sizeof() as well. That's not a bug but the cast is unnecessary.

GHSA

GHSA-7hqf-f5qc-8535: In the Linux kernel, the following vulnerability has been resolved: io_uring/net: fix overflow check in io_recvmsg_mshot_prep() The "controllen" var

ghsa_unreviewed·2024-05-17

CVE-2024-35827 [MEDIUM] CWE-190 GHSA-7hqf-f5qc-8535: In the Linux kernel, the following vulnerability has been resolved: io_uring/net: fix overflow check in io_recvmsg_mshot_prep() The "controllen" var In the Linux kernel, the following vulnerability has been resolved: io_uring/net: fix overflow check in io_recvmsg_mshot_prep() The "controllen" variable is type size_t (unsigned long). Casting it to int could lead to an integer underflow. The check_add_overflow() function considers the type of the destination which is type int. If we add two positive values and the result cannot fit in an integer then that's counted as an overflow. However, if we cast "controllen" to an int and it turns negative, then negative values *can* fit into an int type so there is no overflow. Good: 100 + (unsigned long)-4 = 96 <-- overflow Bad: 100 + (int)-4 = 96 <-- no overflow I deleted the cast of the sizeof() as well. That's not a bug but the cast is unnecessary.

CVE-2024-35827: In the Linux kernel, the following vulnerability has been resolved: io_uring/net: fix overflow check in io_recvmsg_mshot_prep() The "controllen" variable is…

Affected

CVSS provenance