VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Jun 19, 2024· Updated May 12, 2026

CVE-2024-38579

CVE-2024-38579

Description

In the Linux kernel, the following vulnerability has been resolved:

crypto: bcm - Fix pointer arithmetic

In spu2_dump_omd() value of ptr is increased by ciph_key_len instead of hash_iv_len which could lead to going beyond the buffer boundaries. Fix this bug by changing ciph_key_len to hash_iv_len.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In the Linux kernel's Broadcom crypto driver, an off-by-one pointer arithmetic error in spu2_dump_omd() could lead to an out-of-bounds read.

Vulnerability

In the Linux kernel's Broadcom crypto driver (bcm), the function spu2_dump_omd() contains a pointer arithmetic bug. The code incorrectly increments the pointer ptr by ciph_key_len instead of hash_iv_len, which can cause the pointer to advance beyond the intended buffer boundaries [1][2]. This error was discovered by the Linux Verification Center using the SVACE static analysis tool.

Exploitation

Exploitation of this vulnerability requires local access to the system and the ability to trigger the spu2_dump_omd() code path, most likely through crafted cryptographic operations that cause the driver to dump operation metadata. An attacker does not need special privileges beyond being able to interact with the crypto subsystem, and no user interaction is required beyond the system's normal operation.

Impact

A successful exploit could result in an out-of-bounds read, potentially disclosing sensitive kernel memory contents or causing a system crash (denial of service). The CVSS v3 base score is 5.5, with a vector of AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H, indicating high confidentiality and availability impacts but requiring local access and user interaction.

Mitigation

The fix has been applied in the Linux kernel repository, correcting the pointer arithmetic by changing ciph_key_len to hash_iv_len [1]. Users should apply the latest kernel updates from their distribution to remediate this issue. Products such as Siemens SIMATIC S7-1500 TM MFP (GNU/Linux subsystem) are known to be affected and will receive updates as part of their security advisory process [2].

References
  1. SSA-613116
  2. SSA-265688

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

179

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

12

News mentions

0

No linked articles in our index yet.