Security readout for executives and security teams
Plain-English summary
A Linux kernel race can leave another driver using memory after an inaccessible AT24 EEPROM device is removed. Successful triggering could crash the system or corrupt kernel memory, potentially affecting confidentiality and integrity. Exposure appears limited to systems using the affected EEPROM and nvmem code paths under specific timing conditions.
Executive priority
Treat as a high-priority maintenance issue for embedded, appliance, industrial, and server systems that actually use AT24 EEPROM devices. Broader fleets without this hardware path can be triaged lower after validation. Patch during the next appropriate maintenance window, accelerating systems showing EEPROM access failures or unexplained kernel instability.
Technical view
The AT24 driver registered an nvmem device before confirming that the EEPROM was accessible. A failed read then caused teardown, while a concurrent driver could retain and dereference invalid memory. The correction moves the accessibility failure before nvmem registration. CVSS 3.1 is 7.0: local, high complexity, low privileges, no user interaction.
Likely exposure
Most relevant to Linux systems with AT24-compatible EEPROM hardware and another driver consuming its nvmem device. The bundle identifies Linux 5.3 and several stable correction points, but its version data is not fully normalized. Confirm exposure against the deployed distribution kernel and whether it contains the applicable stable fix.
Exploitation context
The supplied sources do not report active exploitation, and the CVE is not listed as KEV in the bundle. Exploitation requires local access, low privileges, a high-complexity race, an inaccessible EEPROM, and concurrent nvmem access. These constraints reduce likelihood, although kernel memory corruption makes successful exploitation consequential.
Researcher notes
This is a teardown race producing an invalid-memory reference in kernel context. The source bundle supplies no CWE and no evidence demonstrating practical privilege escalation or active exploitation. Researchers should distinguish theoretical CVSS impacts from proven outcomes and map fixes by stable branch or distribution backport because the bundled affected-version representation is ambiguous.
Mitigation direction
- Install a vendor-supported kernel containing the applicable upstream stable fix.
- Confirm the distribution backport rather than relying only on the displayed kernel version.
- Prioritize updates for systems using AT24 EEPROM and nvmem consumers.
- If updating is delayed, consult the Linux distribution's guidance for supported mitigations.
Validation and detection
- Inventory deployed kernel versions and distribution patch levels.
- Determine whether AT24 EEPROM support and dependent nvmem consumers are present.
- Verify that the applicable stable commit is included or backported.
- Review kernel logs for AT24 access failures, nvmem errors, crashes, or memory-corruption symptoms.
- After updating, confirm the corrected kernel is running following reboot.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-35848 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H15.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7HighVector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/c850f71fca09ea41800ed55905980063d17e01daCVE reference, Linux
- https://git.kernel.org/stable/c/26d32bec4c6d255a03762f33c637bfa3718be15aCVE reference, Linux
- https://git.kernel.org/stable/c/c43e5028f5a35331eb25017f5ff6cc21735005c6CVE reference, Linux
- https://git.kernel.org/stable/c/2af84c46b9b8f2d6c0f88d09ee5c849ae1734676CVE reference, Linux
- https://git.kernel.org/stable/c/6d8b56ec0c8f30d5657382f47344a32569f7a9bcCVE reference, Linux
- https://git.kernel.org/stable/c/f42c97027fb75776e2e9358d16bf4a99aeb04cf2CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2024/06/msg00019.htmlCVE reference, CVE · x_transferred
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.