Go to homepageCyberStrike

Menu

Star on GitHub · 3.4k
Sign inDownload

CVE-2024-35995

5.5 · MEDIUM

In the Linux kernel, the following vulnerability has been resolved: ACPI: CPPC: Use access_width over bit_width for system memory accesses To align with ACPI 6.3+, since bit_width can be any 8-bi…

Published May 20, 2024EPSS 0.21%

Overview

CVE-2024-35995 is a medium-severity vulnerability. It was published on May 20, 2024 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

Technical description

In the Linux kernel, the following vulnerability has been resolved:

ACPI: CPPC: Use access_width over bit_width for system memory accesses

To align with ACPI 6.3+, since bit_width can be any 8-bit value, it

cannot be depended on to be always on a clean 8b boundary. This was

uncovered on the Cobalt 100 platform.

SError Interrupt on CPU26, code 0xbe000011 -- SError

CPU: 26 PID: 1510 Comm: systemd-udevd Not tainted 5.15.2.1-13 #1

Hardware name: MICROSOFT CORPORATION, BIOS MICROSOFT CORPORATION

pstate: 62400009 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)

pc : cppc_get_perf_caps+0xec/0x410

lr : cppc_get_perf_caps+0xe8/0x410

sp : ffff8000155ab730

x29: ffff8000155ab730 x28: ffff0080139d0038 x27: ffff0080139d0078

x26: 0000000000000000 x25: ffff0080139d0058 x24: 00000000ffffffff

x23: ffff0080139d0298 x22: ffff0080139d0278 x21: 0000000000000000

x20: ffff00802b251910 x19: ffff0080139d0000 x18: ffffffffffffffff

x17: 0000000000000000 x16: ffffdc7e111bad04 x15: ffff00802b251008

x14

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References

Refgit.kernel.org/stable/c/01fc53be672acae37e611c80cc0b4f3939584de3Refgit.kernel.org/stable/c/1b890ae474d19800a6be1696df7fb4d9a41676e4Refgit.kernel.org/stable/c/2f4a4d63a193be6fd530d180bb13c3592052904cRefgit.kernel.org/stable/c/6cb6b12b78dcd8867a3fdbb1b6d0ed1df2b208d1Refgit.kernel.org/stable/c/01fc53be672acae37e611c80cc0b4f3939584de3Refgit.kernel.org/stable/c/1b890ae474d19800a6be1696df7fb4d9a41676e4Refgit.kernel.org/stable/c/2f4a4d63a193be6fd530d180bb13c3592052904cRefgit.kernel.org/stable/c/4949affd5288b867cdf115f5b08d6166b2027f87Refgit.kernel.org/stable/c/6cb6b12b78dcd8867a3fdbb1b6d0ed1df2b208d1Refgit.kernel.org/stable/c/6dfd79ed04c578f1d9a9a41ba5b2015cf9f03fc3

How CyberStrike helps

Frequently asked questions

What is CVE-2024-35995?

CVE-2024-35995 is a medium-severity vulnerability. It was published on May 20, 2024 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2024-35995?

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2024-35995?

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2024-35995?

CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2024-35995 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.

Related MEDIUM CVEs from 2024

View all
Browse by year2026202520242023202220212020201920182017201620152014201320122011201020092008200720062005200420032002200120001999
LiveWatch live →