Security readout for executives and security teams
Plain-English summary
A Linux TPM-over-SPI driver allocated a transfer buffer without allowing for the four-byte SPI header. This can cause memory access outside the buffer, potentially crashing or compromising an affected system when the vulnerable driver path is exercised.
Executive priority
Treat this as a high-priority platform update for exposed embedded, appliance, or other TPM-over-SPI systems. Prioritise by confirmed driver use and local-user exposure; broad emergency action across Linux systems is unsupported by the supplied evidence.
Technical view
The tpm_tis_spi transfer code calculated both transfer length and buffer size from MAX_SPI_FRAMESIZE but omitted the four-byte header prepended to each SPI frame. KASAN confirmed out-of-bounds access. The kernel correction introduces SPI_HDRSIZE and includes it when allocating the transfer buffer.
Likely exposure
Exposure is limited to Linux systems using the TPM-over-SPI driver path. The bundle lists 6.6, 6.6.33, 6.9.4, and 6.10 as affected entries, but does not provide sufficiently clear version ranges. Distribution backports may alter applicability.
Exploitation context
The CVSS vector describes a local, low-complexity attack requiring low privileges and no user interaction, with potentially high confidentiality, integrity, and availability impact. The CVE is not listed as KEV, and the supplied sources provide no evidence of active exploitation.
Researcher notes
The memory-safety defect and correction are clearly described, and KASAN reproduced the out-of-bounds access. However, the source bundle's affected-version data is ambiguous and includes an unexplained “0” entry. Confirm branch ancestry and downstream backports before declaring a specific build vulnerable or fixed.
Mitigation direction
- Install a vendor-supported kernel containing the SPI_HDRSIZE allocation correction or an equivalent backport.
- Prioritise systems that use TPM hardware connected through SPI.
- Consult the Linux distribution or device vendor for exact fixed package versions.
- Restrict local access and unnecessary untrusted workloads until affected systems are updated.
Validation and detection
- Determine whether each system uses the Linux TPM-over-SPI driver path.
- Record installed kernel and distribution package versions.
- Confirm the installed kernel includes the referenced correction or a vendor backport.
- Review kernel crash and memory-safety telemetry associated with TPM SPI operations.
- Retest representative TPM operations after updating.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-36477 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/1547183852dcdfcc25878db7dd3620509217b0cdCVE reference, Linux
- https://git.kernel.org/stable/c/de13c56f99477b56980c7e00b09c776d16b7563dCVE reference, Linux
- https://git.kernel.org/stable/c/195aba96b854dd664768f382cd1db375d8181f88CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.