Security readout for executives and security teams
Plain-English summary
A local user with access to Linux GPIO lines may trigger an unsafe event-buffer state. This can expose unintended kernel memory through returned events or disrupt the system. The flaw requires a specific sequence involving software debounce and later edge detection, so exposure depends on GPIO availability and permissions.
Executive priority
Treat as a high-priority patching item for GPIO-enabled systems with untrusted local users or shared workloads. Prioritize embedded and operational environments where disruption or kernel-memory disclosure matters. Systems without accessible GPIO interfaces are less likely to be exposed.
Technical view
The GPIO character-device path can omit kfifo allocation when software debounce is already active and a line is reconfigured for edge detection. Subsequent event reads and writes use an uninitialised kfifo. The supplied CVSS 3.1 score is 7.1, reflecting local, low-privilege access with potentially high confidentiality and availability impact.
Likely exposure
Linux systems using the GPIO character-device interface are candidates, especially embedded, industrial, appliance, and hardware-control environments. Practical exposure requires software debounce, subsequent edge-detection reconfiguration, and local access to the relevant GPIO line. The bundle lists several affected kernel releases, but does not clearly define complete vulnerable version ranges.
Exploitation context
The supplied CVSS vector indicates local access, low privileges, low complexity, and no user interaction. The bundle does not identify remote exploitation, public exploitation, or inclusion in CISA KEV; therefore active exploitation should not be assumed.
Researcher notes
The corrective change initializes the event kfifo when software debounce is already active. No CWE is supplied. The source bundle presents version entries without clear range semantics, so affected and fixed boundaries should be confirmed through Linux distribution advisories and the referenced stable commits.
Mitigation direction
- Apply distribution or vendor kernel updates that incorporate the referenced stable fixes.
- Prioritize systems exposing GPIO character devices to untrusted or lower-privileged local users.
- Restrict access to relevant GPIO devices until updates can be deployed.
- Check vendor advisories for exact affected and fixed package versions.
Validation and detection
- Record running kernel and distribution package versions on systems exposing GPIO interfaces.
- Compare package builds against vendor guidance and the referenced stable kernel fixes.
- Review permissions and group membership controlling GPIO character-device access.
- Confirm applications use software debounce followed by edge-detection reconfiguration.
- After updating, verify deployed kernels contain the applicable upstream fix.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-36898 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2LinuxVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/c87cc32bc48b187067e089b15ab7a6a7eed5767dCVE reference, Linux
- https://git.kernel.org/stable/c/1a51e24404d77bb3307c1e39eee0d8e86febb1a5CVE reference, Linux
- https://git.kernel.org/stable/c/883e4bbf06eb5fb7482679e4edb201093e9f55a2CVE reference, Linux
- https://git.kernel.org/stable/c/bd7139a70ee8d8ea872b223e043730cf6f5e2b0eCVE reference, Linux
- https://git.kernel.org/stable/c/ee0166b637a5e376118e9659e5b4148080f1d27eCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.