VYPR
← All advisories
Medium severity5.5NVD Advisory· Published May 17, 2024· Updated May 12, 2026

CVE-2024-35813

CVE-2024-35813

Description

In the Linux kernel, the following vulnerability has been resolved:

mmc: core: Avoid negative index with array access

Commit 4d0c8d0aef63 ("mmc: core: Use mrq.sbc in close-ended ffu") assigns prev_idata = idatas[i - 1], but doesn't check that the iterator i is greater than zero. Let's fix this by adding a check.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A missing bounds check in the Linux kernel's MMC core can lead to a negative array index access, potentially causing a denial of service.

Vulnerability

Overview

CVE-2024-35813 is a flaw in the Linux kernel's MMC (MultiMediaCard) core subsystem. The vulnerability was introduced by commit 4d0c8d0aef63 ("mmc: core: Use mrq.sbc in close-ended ffu"), which assigns prev_idata = idatas[i - 1] without first verifying that the loop iterator i is greater than zero. This oversight allows a negative array index to be used, leading to an out-of-bounds memory access [1].

Exploitation

Conditions

The bug is triggered during close-ended field firmware update (FFU) operations on MMC devices. An attacker would need local access to the system or the ability to inject malicious FFU commands, for example by inserting a crafted SD/MMC card or exploiting another vulnerability to gain low-privilege code execution. No special authentication is required beyond the ability to interact with the MMC subsystem.

Impact

A successful exploit can cause the kernel to read from or write to an invalid memory location, resulting in a system crash (denial of service). The CVSS v3 base score of 5.5 (Medium) reflects the requirement for local access and the potential for availability impact.

Mitigation

The Linux kernel community has released patches that add a bounds check for i > 0 before the assignment. These fixes have been backported to stable kernel branches. Siemens has also acknowledged the vulnerability in its SIMATIC S7-1500 TM MFP - GNU/Linux subsystem and recommends applying the kernel update [1].

References
  1. SSA-265688

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

97

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

10

News mentions

0

No linked articles in our index yet.