Linux Kernel
CVE-2024-36016
HIGH
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitation requires coordinating a specific multi-step mode-switch frame sequence with a controlled GSM peer, making AC:H more accurate than the NVD-assigned AC:L.
Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).
CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
Assuming the following:
- side A configures the n_gsm in basic option mode
- side B sends the header of a basic option mode frame with data length 1
- side A switches to advanced option mode
- side B sends 2 data bytes which exceeds gsm->len
Reason: gsm->len is not used in advanced option mode.
- side A switches to basic option mode
- side B keeps sending until gsm0_receive() writes past gsm->buf
Reason: Neither gsm->state nor gsm->len have been reset after reconfiguration.
Fix this by changing gsm->count to gsm->len comparison from equal to less than. Also add upper limit checks against the constant MAX_MRU in gsm0_receive() and gsm1_receive() to harden against memory corruption of gsm->len and gsm->mru.
All other checks remain as we still need to limit the data according to the user configuration and actual payload size.
AnalysisAI
Out-of-bounds memory corruption in the Linux kernel's n_gsm tty line discipline allows a local attacker with TTY device access to write past the end of gsm->buf by orchestrating a specific mode-switch sequence between basic and advanced GSM 07.10 framing modes. The root cause is that gsm->state and gsm->len are not reset upon reconfiguration, permitting gsm0_receive() to exceed its buffer boundary when the peer continues sending data after a mode transition. Patches are available across multiple stable kernel trees; no public exploit code or CISA KEV listing has been identified, and EPSS sits at 0.28% (19th percentile), indicating low current exploitation activity despite the high-severity CVSS score.
Technical ContextAI
The n_gsm kernel module implements the 3GPP TS 27.010 / GSM 07.10 serial multiplexing protocol as a TTY line discipline, supporting two framing modes: basic option mode (byte-oriented framing with an explicit length field in gsm->len) and advanced option mode (HDLC-style framing where gsm->len is not used). The gsm0_receive() and gsm1_receive() functions process incoming bytes using gsm->state as a state machine and gsm->count as an accumulation counter. The root cause maps to CWE-125 (out-of-bounds read) per NVD classification, though the described mechanism also involves out-of-bounds writes to gsm->buf. The critical flaw is a state management gap: when the multiplexer is reconfigured between modes at runtime, neither gsm->state nor gsm->len is reset, so a crafted sequence - basic mode frame header declaring length 1, mid-stream switch to advanced mode injecting extra bytes, then reversion to basic mode - causes gsm->count to exceed the gsm->buf allocation without triggering the equality-based boundary check. The fix changes the check from equality (count == len) to less-than (count < len) and adds hard upper-bound guards against MAX_MRU in both receive paths. The CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* with wildcard version confirms broad kernel-version impact across all branches shipping n_gsm.
RemediationAI
The primary remediation is to apply one of the nine upstream stable kernel patches available at git.kernel.org/stable (commits 0fb736c9, 46f52c89, 47388e80, 4c267110, 774d83b0, 9513d414, b229bc6c, b890d45a, f126ce73). Downstream users should update to the patched kernel version shipped by their distribution once vendor advisories confirm inclusion. As a compensating control where immediate patching is not feasible, administrators can blacklist the n_gsm module by adding the line install n_gsm /bin/false to /etc/modprobe.d/blacklist-n_gsm.conf and rebooting; note this completely disables GSM 07.10 serial multiplexing functionality and will break any dependent applications or hardware. On systems where the module is required, access to serial TTY devices should be restricted via udev rules or file permissions to prevent unauthorized users from attaching the n_gsm line discipline. Restricting physical access to serial ports hosting GSM modems further limits the ability of an attacker to control the GSM peer - a prerequisite for exploitation. Exact fixed distribution release version numbers are not independently confirmed from the available data; track your vendor's kernel security channel for specifics.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today