CVE-2024-38569: drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group
In the Linux kernel, the following vulnerability has been resolved:
drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group
The perf tool allows users to create event groups through following
cmd [1], but the driver does not check whether the array index is out of
bounds when writing data to the event_group array. If the number of events
in an event_group is greater than HISI_PCIE_MAX_COUNTERS, the memory write
overflow of event_group array occurs.
Add array index check to fix the possible array out of bounds violation,
and return directly when write new events are written to array bounds.
There are 9 different events in an event_group.
[1] perf stat -e '{pmu/event1/, ... ,pmu/event9/}'
Security readout for executives and security teams
Plain-English summary
CVE-2024-38569 is a Linux kernel bug in the HiSilicon PCIe perf driver. A perf event group with too many events can make the driver write past its event_group array. Business impact depends on whether affected kernels and this driver are present.
Executive priority
Treat this as a targeted kernel maintenance issue, not a broad emergency based on available evidence. Prioritize affected Linux fleets with relevant HiSilicon PCIe perf support, and confirm vendor patch coverage through normal kernel update channels.
Technical view
The hisi_pcie perf driver failed to validate the event_group array index. When a perf event group contains more events than HISI_PCIE_MAX_COUNTERS, the driver can perform an out-of-bounds memory write. The Linux stable fixes add bounds checking and return when new events exceed array bounds.
Likely exposure
Likely exposure is limited to Linux systems running affected kernel versions with the hisi_pcie perf PMU driver available and users able to create perf event groups. The source bundle does not identify distributions, hardware deployments, or default reachability.
Exploitation context
The source describes a perf command pattern that can create an oversized event group, but it does not report public exploitation, weaponized exploit code, or KEV listing. CISA KEV status is false in the bundle.
Researcher notes
Evidence supports an out-of-bounds write in drivers/perf/hisi_pcie triggered by oversized perf event groups. Impact severity, privilege requirements, and practical exploitability are not scored in the bundle. Avoid assuming remote exposure or active exploitation without additional vendor evidence.
Mitigation direction
Update to a Linux kernel build that includes the referenced stable fixes.
Check your Linux distribution advisories for backported fixes for CVE-2024-38569.
Prioritize systems using HiSilicon PCIe performance monitoring hardware or related kernel support.
If patch status is unclear, follow vendor guidance before assuming a workaround.
Validation and detection
Inventory Linux kernel versions against the affected version data in the CVE record.
Confirm whether the hisi_pcie perf driver is built, loaded, or relevant on target systems.
Verify the deployed kernel includes one of the referenced stable fix commits or a vendor backport.
Review local perf event usage exposure where affected systems support this PMU.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2024-38569 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.