CVE-2024-36965

remoteproc: mediatek: Make sure IPI buffer fits in L2TCM

State: Published
Severity: 7.8 High
Published: Jun 8, 2024
Updated: Aug 5, 2026
Reserved: May 30, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

remoteproc: mediatek: Make sure IPI buffer fits in L2TCM

The IPI buffer location is read from the firmware that we load to the System Companion Processor, and it's not granted that both the SRAM (L2TCM) size that is defined in the devicetree node is large enough for that, and while this is especially true for multi-core SCP, it's still useful to check on single-core variants as well.

Failing to perform this check may make this driver perform R/W operations out of the L2TCM boundary, resulting (at best) in a kernel panic.

To fix that, check that the IPI buffer fits, otherwise return a failure and refuse to boot the relevant SCP core (or the SCP at all, if this is single core).

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	3efa0ea743b77d1611501f7d8b4f320d032d73ae to before 00548ac6b14428719c970ef90adae2b3b48c0cdfAffected 3efa0ea743b77d1611501f7d8b4f320d032d73ae to before 1d9e2de24533daca36cbf09e8d8596bf72b526b2Affected 3efa0ea743b77d1611501f7d8b4f320d032d73ae to before 26c6d7dc8c6a9fde9d362ab2eef6390efeff145eAffected 3efa0ea743b77d1611501f7d8b4f320d032d73ae to before 838b49e211d59fa827ff9df062d4020917cffbdfAffected 3efa0ea743b77d1611501f7d8b4f320d032d73ae to before 36c79eb4845551e9f6d28c663b38ce0ab03b84a9Affected 3efa0ea743b77d1611501f7d8b4f320d032d73ae to before 331f91d86f71d0bb89a44217cc0b2a22810bbd42Affected
LinuxLinux	5.11Affected before 5.11Not affected 5.15.160 through 5.15.Not affected 6.1.92 through 6.1.Not affected 6.6.32 through 6.6.Not affected 6.8.11 through 6.8.Not affected 6.9.2 through 6.9.*Not affected 6.10 and laterNot affected

Product

Versions

LinuxLinux

3efa0ea743b77d1611501f7d8b4f320d032d73ae to before 00548ac6b14428719c970ef90adae2b3b48c0cdfAffected
3efa0ea743b77d1611501f7d8b4f320d032d73ae to before 1d9e2de24533daca36cbf09e8d8596bf72b526b2Affected
3efa0ea743b77d1611501f7d8b4f320d032d73ae to before 26c6d7dc8c6a9fde9d362ab2eef6390efeff145eAffected
3efa0ea743b77d1611501f7d8b4f320d032d73ae to before 838b49e211d59fa827ff9df062d4020917cffbdfAffected
3efa0ea743b77d1611501f7d8b4f320d032d73ae to before 36c79eb4845551e9f6d28c663b38ce0ab03b84a9Affected
3efa0ea743b77d1611501f7d8b4f320d032d73ae to before 331f91d86f71d0bb89a44217cc0b2a22810bbd42Affected

LinuxLinux

5.11Affected
before 5.11Not affected
5.15.160 through 5.15.*Not affected
6.1.92 through 6.1.*Not affected
6.6.32 through 6.6.*Not affected
6.8.11 through 6.8.*Not affected
6.9.2 through 6.9.*Not affected
6.10 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.