Security readout for executives and security teams
Plain-English summary
This is a Linux kernel bug in UBIFS, a flash-oriented filesystem. The kernel could mark a newly allocated page as ready before the correct data was copied into it, allowing a concurrent read to observe stale or incorrect data. Business impact is highest where Linux systems use UBIFS for operational or embedded storage.
Executive priority
Prioritize remediation for Linux fleets that use UBIFS, especially embedded or appliance-like systems where filesystem integrity matters. This is high severity, but the provided sources do not indicate known exploitation. Patch through normal kernel update channels with accelerated handling for UBIFS-dependent systems.
Technical view
UBIFS set PageUptodate too early during write handling. Because page-cache reads are lockless, a racing reader could consume a page before new data had replaced old contents. The upstream resolution moves SetPageUptodate into ubifs_write_end(), after data copy completion. The CVSS 3.1 score is 7.5, rated high.
Likely exposure
Exposure is limited to Linux systems using affected kernel versions with UBIFS in use. The bundle identifies Linux as affected and lists versions from 2.6.27 through 6.9 with stable kernel fix references. Non-UBIFS systems are less likely to be materially exposed.
Exploitation context
The source bundle does not show CISA KEV listing or active exploitation evidence. The issue is a race-condition data integrity flaw, not a documented remote exploit path in the provided sources. Treat exploitation status as unconfirmed unless vendor or threat-intelligence sources provide new evidence.
Researcher notes
The key flaw is incorrect ordering around PageUptodate in UBIFS write completion. Validate exposure by confirming both kernel lineage and UBIFS usage. The provided CWE is CWE-772, though the description is more directly about page-cache state ordering and lockless reads.
Mitigation direction
- Identify Linux assets using UBIFS-backed filesystems.
- Upgrade to vendor kernels containing the referenced upstream stable fixes.
- For Debian LTS systems, review the cited Debian LTS advisories.
- Prioritize embedded, appliance, and flash-storage Linux deployments.
- If patching is delayed, follow vendor-specific operational guidance.
Validation and detection
- Inventory kernel versions across Linux assets.
- Confirm whether UBIFS is mounted or used on each asset.
- Map installed kernels against vendor advisories and fixed builds.
- Verify the relevant stable patch is included in source or package changelogs.
- Document systems that are not exposed because UBIFS is absent.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit 4aa554832b9d
- Linux stable commit 778c6ad40256
- Linux stable commit 8f599ab6fabb
- Linux stable commit f19b1023a375
- Linux stable commit 142d87c958d9
- Linux stable commit fc99f4e2d2f1
- Linux stable commit 4b7c4fc60d6a
- Linux stable commit 17772bbe9cfa
- Linux stable commit 723012cab779
- Debian LTS advisory
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-772: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-35821 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N3.93.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/4aa554832b9dc9e66249df75b8f447d87853e12eCVE reference, Linux
- https://git.kernel.org/stable/c/778c6ad40256f1c03244fc06d7cdf71f6b5e7310CVE reference, Linux
- https://git.kernel.org/stable/c/8f599ab6fabbca4c741107eade70722a98adfd9fCVE reference, Linux
- https://git.kernel.org/stable/c/f19b1023a3758f40791ec166038d6411c8894ae3CVE reference, Linux
- https://git.kernel.org/stable/c/142d87c958d9454c3cffa625fab56f3016e8f9f3CVE reference, Linux
- https://git.kernel.org/stable/c/fc99f4e2d2f1ce766c14e98463c2839194ae964fCVE reference, Linux
- https://git.kernel.org/stable/c/4b7c4fc60d6a46350fbe54f5dc937aeaa02e675eCVE reference, Linux
- https://git.kernel.org/stable/c/17772bbe9cfa972ea1ff827319f6e1340de76566CVE reference, Linux
- https://git.kernel.org/stable/c/723012cab779eee8228376754e22c6594229bf8fCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.htmlCVE reference, CVE · x_transferred
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.htmlCVE reference, CVE · x_transferred
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Release of Resource after Effective Lifetime
Missing Release of Resource after Effective Lifetime represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.