CVE-2024-38635

HighCVSS 7.1/10Last modified Oct 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

soundwire: cadence: fix invalid PDI offset

For some reason, we add an offset to the PDI, presumably to skip the PDI0 and PDI1 which are reserved for BPT.

This code is however completely wrong and leads to an out-of-bounds access. We were just lucky so far since we used only a couple of PDIs and remained within the PDI array bounds.

A Fixes: tag is not provided since there are no known platforms where the out-of-bounds would be accessed, and the initial code had problems as well.

A follow-up patch completely removes this useless offset.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published
Jun 21, 2024
Last modified
Oct 15, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-386365.5In the Linux kernel, the following vulnerability has been resolved: f2fs: multidev: fix to recognize valid zero block address As reported CVE-2024-386375.5In the Linux kernel, the following vulnerability has been resolved: greybus: lights: check return of get_channel_from_mode If channel for CVE-2024-386387.2An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability couCVE-2024-386394.8An improper authentication vulnerability has been reported to affect product. The remote attackers can then exploit the vulnerability to comCVE-2024-38648.1Memory safety bug present in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9. This bug showed evidence of memory corruption and we preCVE-2024-386405.4A cross-site scripting (XSS) vulnerability has been reported to affect Download Station. If exploited, the vulnerability could allow authentCVE-2024-386417.8An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability coCVE-2024-386427.8An improper certificate validation vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow local netwCVE-2024-386439.8A missing authentication for critical function vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability coCVE-2024-386448.8An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote authenCVE-2024-386456.5A server-side request forgery (SSRF) vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow CVE-2024-386466.0An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If exploited, the vulner
CVE-2024-38635: High severity, CVSS 7.1 | Vulnix