Security readout for executives and security teams
Plain-English summary
A Linux kernel error path can release the same memory twice when interrupt initialization partially succeeds and then fails. This could corrupt kernel memory, crash an affected system, or potentially compromise confidentiality and integrity. The supplied CVSS score is 7.8 and requires local, low-privileged access.
Executive priority
Prioritize affected multi-user or otherwise locally accessible systems because successful impact occurs in kernel context. Schedule prompt patching through normal kernel maintenance. Internet-only exposure is not established by the supplied evidence, and emergency response is not justified solely by active-exploitation concerns.
Technical view
The flaw is in its_vpe_irq_domain_alloc() within the GIC-v3 ITS interrupt controller code. If its_vpe_init() fails after allocating an interrupt, cleanup previously freed interrupts, the area bitmap, and vprop_page twice. The kernel fix consolidates cleanup through its_vpe_irq_domain_free().
Likely exposure
Exposure requires a Linux kernel containing the vulnerable code and use of the relevant GIC-v3 ITS path. The supplied affected-version data is ambiguous, so determine exposure using distribution advisories, kernel package changelogs, or inclusion of the referenced stable fix—not version strings alone.
Exploitation context
The CVSS vector indicates local access, low privileges, low complexity, and no user interaction. KEV is false, and the supplied sources provide no evidence of active exploitation or a public exploit. Triggering also depends on interrupt initialization partially succeeding before its_vpe_init() fails.
Researcher notes
This is a kernel double-free in a failure-cleanup path, not an ordinary network-reachable flaw. Practical reachability depends on GIC-v3 ITS configuration and inducing the specified partial-allocation failure. The sources establish the code correction, but do not establish exploitability beyond the supplied CVSS assessment.
Mitigation direction
- Install a vendor-supported kernel containing the applicable stable fix.
- Check distribution advisories and package changelogs for backported remediation.
- Reboot into the updated kernel after installation.
- Limit unnecessary local access until affected systems are remediated.
Validation and detection
- Inventory running kernel versions on relevant Linux systems.
- Confirm whether systems use hardware and kernel paths involving GIC-v3 ITS.
- Compare distribution kernel packages against vendor advisories and referenced fixes.
- After remediation, verify the updated kernel is actively running.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-35847 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/f5417ff561b8ac9a7e53c747b8627a7ab58378aeCVE reference, Linux
- https://git.kernel.org/stable/c/b72d2b1448b682844f995e660b77f2a1fabc1662CVE reference, Linux
- https://git.kernel.org/stable/c/aa44d21574751a7d6bca892eb8e0e9ac68372e52CVE reference, Linux
- https://git.kernel.org/stable/c/5dbdbe1133911ca7d8466bb86885adec32ad9438CVE reference, Linux
- https://git.kernel.org/stable/c/dd681710ab77c8beafe2e263064cb1bd0e2d6ca9CVE reference, Linux
- https://git.kernel.org/stable/c/03170e657f62c26834172742492a8cb8077ef792CVE reference, Linux
- https://git.kernel.org/stable/c/5b012f77abde89bf0be8a0547636184fea618137CVE reference, Linux
- https://git.kernel.org/stable/c/c26591afd33adce296c022e3480dea4282b7ef91CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.htmlCVE reference, CVE · x_transferred
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.htmlCVE reference, CVE · x_transferred
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.