Memory Management Vulnerability in Linux Kernel: Firmware QSEECOM APP_SEND Command
Summary
DEBIAN-CVE-2024-35994: In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: uefisecapp: Fix memory related IO errors and crashes It turns out that while the QSEECOM APP_SEND command has specific fields for reques... Affects linux versions < 6.8.9-1. Fixed in 6.8.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It is widely used across various platforms, including servers, desktops, and embedded systems. This vulnerability affects the firmware component related to Qualcomm's QSEECOM, which is responsible for secure communication between the operating system and trusted execution environments.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the firmware handling of the QSEECOM APP_SEND command. The issue arises because the uefisecapp expects both request and response buffers to be in a single memory region, contrary to the specific fields designated for them. This misalignment can lead to various failures, including no response being written, SCM calls failing, or even hard resets of the device. Although the issue can be triggered deterministically, it has been observed to occur sporadically due to the allocation of memory regions being adjacent, which can lead to unpredictable behavior.
How To Fix
Minimum fixed version
6.8.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The identified vulnerability in the Linux kernel related to the QSEECOM APP_SEND command poses significant risks to system stability and security. Users are strongly encouraged to update to the patched version to mitigate these risks and ensure the integrity of their systems.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves improper memory management in the handling of request and response buffers in the QSEECOM APP_SEND command.
It can lead to failures in communication with the trusted execution environment, resulting in errors, device resets, or system instability.
Yes, a patch has been released in version 6.8.9-1 of the Linux kernel.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
While there are no specific workarounds, it is advisable to monitor your system closely and apply the update as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
