GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-38568 (GCVE-0-2024-38568)

Vulnerability from cvelistv5 – Published: 2024-06-19 13:35 – Updated: 2026-08-05 11:32
VLAI
Title
drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group
Summary
In the Linux kernel, the following vulnerability has been resolved: drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group The perf tool allows users to create event groups through following cmd [1], but the driver does not check whether the array index is out of bounds when writing data to the event_group array. If the number of events in an event_group is greater than HNS3_PMU_MAX_HW_EVENTS, the memory write overflow of event_group array occurs. Add array index check to fix the possible array out of bounds violation, and return directly when write new events are written to array bounds. There are 9 different events in an event_group. [1] perf stat -e '{pmu/event1/, ... ,pmu/event9/}
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 17:14 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 66637ab137b44914356a9dc7a9b3f8ebcf0b0695 , < 3669baf308308385a2ab391324abdde5682af5aa (git)
Affected: 66637ab137b44914356a9dc7a9b3f8ebcf0b0695 , < be1fa711e59c874d049f592aef1d4685bdd22bdf (git)
Affected: 66637ab137b44914356a9dc7a9b3f8ebcf0b0695 , < b5120d322763c15c978bc47beb3b6dff45624304 (git)
Affected: 66637ab137b44914356a9dc7a9b3f8ebcf0b0695 , < aa2d3d678895c8eedd003f1473f87d3f06fe6ec7 (git)
Affected: 66637ab137b44914356a9dc7a9b3f8ebcf0b0695 , < 81bdd60a3d1d3b05e6cc6674845afb1694dd3a0e (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.0
Unaffected: 0 , < 6.0 (semver)
Unaffected: 6.1.93 , ≤ 6.1.* (semver)
Unaffected: 6.6.33 , ≤ 6.6.* (semver)
Unaffected: 6.8.12 , ≤ 6.8.* (semver)
Unaffected: 6.9.3 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:12:25.654Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3669baf308308385a2ab391324abdde5682af5aa"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/be1fa711e59c874d049f592aef1d4685bdd22bdf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b5120d322763c15c978bc47beb3b6dff45624304"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/aa2d3d678895c8eedd003f1473f87d3f06fe6ec7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/81bdd60a3d1d3b05e6cc6674845afb1694dd3a0e"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38568",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:14:25.306503Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:56.398Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/perf/hisilicon/hns3_pmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3669baf308308385a2ab391324abdde5682af5aa",
              "status": "affected",
              "version": "66637ab137b44914356a9dc7a9b3f8ebcf0b0695",
              "versionType": "git"
            },
            {
              "lessThan": "be1fa711e59c874d049f592aef1d4685bdd22bdf",
              "status": "affected",
              "version": "66637ab137b44914356a9dc7a9b3f8ebcf0b0695",
              "versionType": "git"
            },
            {
              "lessThan": "b5120d322763c15c978bc47beb3b6dff45624304",
              "status": "affected",
              "version": "66637ab137b44914356a9dc7a9b3f8ebcf0b0695",
              "versionType": "git"
            },
            {
              "lessThan": "aa2d3d678895c8eedd003f1473f87d3f06fe6ec7",
              "status": "affected",
              "version": "66637ab137b44914356a9dc7a9b3f8ebcf0b0695",
              "versionType": "git"
            },
            {
              "lessThan": "81bdd60a3d1d3b05e6cc6674845afb1694dd3a0e",
              "status": "affected",
              "version": "66637ab137b44914356a9dc7a9b3f8ebcf0b0695",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/perf/hisilicon/hns3_pmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.93",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.33",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.12",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.3",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers/perf: hisi: hns3: Fix out-of-bound access when valid event group\n\nThe perf tool allows users to create event groups through following\ncmd [1], but the driver does not check whether the array index is out\nof bounds when writing data to the event_group array. If the number of\nevents in an event_group is greater than HNS3_PMU_MAX_HW_EVENTS, the\nmemory write overflow of event_group array occurs.\n\nAdd array index check to fix the possible array out of bounds violation,\nand return directly when write new events are written to array bounds.\n\nThere are 9 different events in an event_group.\n[1] perf stat -e \u0027{pmu/event1/, ... ,pmu/event9/}"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached solely through the local `perf_event_open(2)` syscall against the HNS3 PMU device exposed under /sys/bus/event_source/devices/; no network or remote input path exists. Attack Vector is therefore Local.\nAC:L - Exploitation is fully deterministic and requires no race, no memory-layout guessing, and no victim state \u2014 the attacker simply opens nine events in one group (`perf stat -e \u0027{pmu/event1/,...,pmu/event9/}\u0027`, the reproducer named in the fix), using `attr.disabled=1` to keep the hardware counters unallocated so the `-EBUSY` pre-check is bypassed. Every condition is under the attacker\u0027s direct control.\nPR:L - An unprivileged local account suffices on the realistic deployment for this driver \u2014 HiSilicon Kunpeng ARM64 servers with NIC PMU profiling enabled, where `kernel.perf_event_paranoid` is set to 0/-1 or CAP_PERFMON is delegated to an observability agent; CAP_PERFMON is explicitly a de-privileged, delegatable capability rather than real root/admin. No authentication beyond a local login is needed, and the OOB write itself executes in `event_init()` before `perf_allow_cpu()` is ever consulted.\nUI:N - The attacker triggers the entire sequence from its own process via repeated `perf_event_open()` calls. No action by any other user or administrator is involved.\nS:U - The out-of-bounds write corrupts the kernel stack of the calling task within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The bug is kernel-stack memory corruption whose written value is a slab pointer to an attacker-groomed `struct perf_event`, landing on adjacent frame state (canary/saved-register slot) that can be leveraged to influence subsequent kernel execution and disclose kernel memory. Per the memory-corruption guidance this is scored High.\nI:H - This is an out-of-bounds *write* past a stack array, and the attacker controls which `perf_event` object\u0027s address is written by ordering the group\u0027s event allocations, giving corruption of control-relevant stack data. Out-of-bounds writes are scored High.\nA:H - On kernels built with CONFIG_STACKPROTECTOR_STRONG (standard for arm64 distro/server kernels) the overwritten slot is the stack canary, so `__stack_chk_fail()` invokes `panic()` unconditionally \u2014 a guaranteed, repeatable full system crash; without the protector it corrupts saved frame state and oopses."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:32:49.356Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3669baf308308385a2ab391324abdde5682af5aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/be1fa711e59c874d049f592aef1d4685bdd22bdf"
        },
        {
          "url": "https://git.kernel.org/stable/c/b5120d322763c15c978bc47beb3b6dff45624304"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa2d3d678895c8eedd003f1473f87d3f06fe6ec7"
        },
        {
          "url": "https://git.kernel.org/stable/c/81bdd60a3d1d3b05e6cc6674845afb1694dd3a0e"
        }
      ],
      "title": "drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-38568",
    "datePublished": "2024-06-19T13:35:34.925Z",
    "dateReserved": "2024-06-18T19:36:34.923Z",
    "dateUpdated": "2026-08-05T11:32:49.356Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-38568",
      "date": "2026-09-17",
      "epss": "0.00234",
      "percentile": "0.14513"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.0\", \"versionEndExcluding\": \"6.1.93\", \"matchCriteriaId\": \"ED79E4A4-4141-4FBC-B01D-4EB8ADBA1958\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.33\", \"matchCriteriaId\": \"FCE796DF-3B50-4DC6-BAE5-95271068FC9E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.8.12\", \"matchCriteriaId\": \"80550309-67AB-4FD1-AC07-3DED5C4F01B2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.9\", \"versionEndExcluding\": \"6.9.3\", \"matchCriteriaId\": \"E07124C1-19E8-4D21-828D-9932A01D3011\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrivers/perf: hisi: hns3: Fix out-of-bound access when valid event group\\n\\nThe perf tool allows users to create event groups through following\\ncmd [1], but the driver does not check whether the array index is out\\nof bounds when writing data to the event_group array. If the number of\\nevents in an event_group is greater than HNS3_PMU_MAX_HW_EVENTS, the\\nmemory write overflow of event_group array occurs.\\n\\nAdd array index check to fix the possible array out of bounds violation,\\nand return directly when write new events are written to array bounds.\\n\\nThere are 9 different events in an event_group.\\n[1] perf stat -e \u0027{pmu/event1/, ... ,pmu/event9/}\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drivers/perf: hisi: hns3: corrige el acceso fuera de los l\\u00edmites cuando el grupo de eventos es v\\u00e1lido. La herramienta perf permite a los usuarios crear grupos de eventos mediante el siguiente cmd [1], pero el controlador no comprueba si el \\u00edndice de la matriz est\\u00e1 fuera de los l\\u00edmites al escribir datos en la matriz event_group. Si el n\\u00famero de eventos en un event_group es mayor que HNS3_PMU_MAX_HW_EVENTS, se produce un desbordamiento de escritura en la memoria de la matriz event_group. Agregue la verificaci\\u00f3n del \\u00edndice de la matriz para corregir la posible infracci\\u00f3n de la matriz fuera de los l\\u00edmites y regrese directamente cuando se escriban nuevos eventos en los l\\u00edmites de la matriz. Hay 9 eventos diferentes en un grupo de eventos. [1] estad\\u00edstica de rendimiento -e \u0027{pmu/event1/, ...,pmu/event9/}\"}]",
      "id": "CVE-2024-38568",
      "lastModified": "2024-11-21T09:26:22.137",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-06-19T14:15:16.950",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/3669baf308308385a2ab391324abdde5682af5aa\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/81bdd60a3d1d3b05e6cc6674845afb1694dd3a0e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/aa2d3d678895c8eedd003f1473f87d3f06fe6ec7\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/b5120d322763c15c978bc47beb3b6dff45624304\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/be1fa711e59c874d049f592aef1d4685bdd22bdf\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/3669baf308308385a2ab391324abdde5682af5aa\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/81bdd60a3d1d3b05e6cc6674845afb1694dd3a0e\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/aa2d3d678895c8eedd003f1473f87d3f06fe6ec7\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/b5120d322763c15c978bc47beb3b6dff45624304\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/be1fa711e59c874d049f592aef1d4685bdd22bdf\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-129\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-38568\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-06-19T14:15:16.950\",\"lastModified\":\"2026-08-04T11:18:44.880\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrivers/perf: hisi: hns3: Fix out-of-bound access when valid event group\\n\\nThe perf tool allows users to create event groups through following\\ncmd [1], but the driver does not check whether the array index is out\\nof bounds when writing data to the event_group array. If the number of\\nevents in an event_group is greater than HNS3_PMU_MAX_HW_EVENTS, the\\nmemory write overflow of event_group array occurs.\\n\\nAdd array index check to fix the possible array out of bounds violation,\\nand return directly when write new events are written to array bounds.\\n\\nThere are 9 different events in an event_group.\\n[1] perf stat -e \u0027{pmu/event1/, ... ,pmu/event9/}\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drivers/perf: hisi: hns3: corrige el acceso fuera de los l\u00edmites cuando el grupo de eventos es v\u00e1lido. La herramienta perf permite a los usuarios crear grupos de eventos mediante el siguiente cmd [1], pero el controlador no comprueba si el \u00edndice de la matriz est\u00e1 fuera de los l\u00edmites al escribir datos en la matriz event_group. Si el n\u00famero de eventos en un event_group es mayor que HNS3_PMU_MAX_HW_EVENTS, se produce un desbordamiento de escritura en la memoria de la matriz event_group. Agregue la verificaci\u00f3n del \u00edndice de la matriz para corregir la posible infracci\u00f3n de la matriz fuera de los l\u00edmites y regrese directamente cuando se escriban nuevos eventos en los l\u00edmites de la matriz. Hay 9 eventos diferentes en un grupo de eventos. [1] estad\u00edstica de rendimiento -e \u0027{pmu/event1/, ...,pmu/event9/}\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/perf/hisilicon/hns3_pmu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"66637ab137b44914356a9dc7a9b3f8ebcf0b0695\",\"lessThan\":\"3669baf308308385a2ab391324abdde5682af5aa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"66637ab137b44914356a9dc7a9b3f8ebcf0b0695\",\"lessThan\":\"be1fa711e59c874d049f592aef1d4685bdd22bdf\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"66637ab137b44914356a9dc7a9b3f8ebcf0b0695\",\"lessThan\":\"b5120d322763c15c978bc47beb3b6dff45624304\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"66637ab137b44914356a9dc7a9b3f8ebcf0b0695\",\"lessThan\":\"aa2d3d678895c8eedd003f1473f87d3f06fe6ec7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"66637ab137b44914356a9dc7a9b3f8ebcf0b0695\",\"lessThan\":\"81bdd60a3d1d3b05e6cc6674845afb1694dd3a0e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/perf/hisilicon/hns3_pmu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.93\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.33\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.12\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.3\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T17:14:25.306503Z\",\"id\":\"CVE-2024-38568\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-129\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.0\",\"versionEndExcluding\":\"6.1.93\",\"matchCriteriaId\":\"ED79E4A4-4141-4FBC-B01D-4EB8ADBA1958\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.33\",\"matchCriteriaId\":\"FCE796DF-3B50-4DC6-BAE5-95271068FC9E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.12\",\"matchCriteriaId\":\"80550309-67AB-4FD1-AC07-3DED5C4F01B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.9\",\"versionEndExcluding\":\"6.9.3\",\"matchCriteriaId\":\"E07124C1-19E8-4D21-828D-9932A01D3011\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3669baf308308385a2ab391324abdde5682af5aa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/81bdd60a3d1d3b05e6cc6674845afb1694dd3a0e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/aa2d3d678895c8eedd003f1473f87d3f06fe6ec7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b5120d322763c15c978bc47beb3b6dff45624304\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/be1fa711e59c874d049f592aef1d4685bdd22bdf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3669baf308308385a2ab391324abdde5682af5aa\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/81bdd60a3d1d3b05e6cc6674845afb1694dd3a0e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/aa2d3d678895c8eedd003f1473f87d3f06fe6ec7\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b5120d322763c15c978bc47beb3b6dff45624304\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/be1fa711e59c874d049f592aef1d4685bdd22bdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:45:17+00:00",
      "cve": "CVE-2024-38568",
      "id": "CVE-2024-38568",
      "initial_release_date": "2024-06-19T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-38568.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-30T02:33:47Z",
      "cve": "CVE-2024-38568",
      "id": "CVE-2024-38568",
      "initial_release_date": "2024-06-22T03:35:13Z",
      "product_status:known_affected": "352",
      "product_status:known_not_affected": "292",
      "product_status:recommended": "651",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-38568",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-38568.json",
      "version": "82"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/3669baf308308385a2ab391324abdde5682af5aa\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/be1fa711e59c874d049f592aef1d4685bdd22bdf\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/b5120d322763c15c978bc47beb3b6dff45624304\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/aa2d3d678895c8eedd003f1473f87d3f06fe6ec7\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/81bdd60a3d1d3b05e6cc6674845afb1694dd3a0e\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:12:25.654Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-38568\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:14:25.306503Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:26.996Z\"}}], \"cna\": {\"title\": \"drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"66637ab137b4\", \"lessThan\": \"3669baf30830\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"66637ab137b4\", \"lessThan\": \"be1fa711e59c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"66637ab137b4\", \"lessThan\": \"b5120d322763\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"66637ab137b4\", \"lessThan\": \"aa2d3d678895\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"66637ab137b4\", \"lessThan\": \"81bdd60a3d1d\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/perf/hisilicon/hns3_pmu.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.0\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.0\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.93\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.33\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/perf/hisilicon/hns3_pmu.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/3669baf308308385a2ab391324abdde5682af5aa\"}, {\"url\": \"https://git.kernel.org/stable/c/be1fa711e59c874d049f592aef1d4685bdd22bdf\"}, {\"url\": \"https://git.kernel.org/stable/c/b5120d322763c15c978bc47beb3b6dff45624304\"}, {\"url\": \"https://git.kernel.org/stable/c/aa2d3d678895c8eedd003f1473f87d3f06fe6ec7\"}, {\"url\": \"https://git.kernel.org/stable/c/81bdd60a3d1d3b05e6cc6674845afb1694dd3a0e\"}], \"x_generator\": {\"engine\": \"bippy-9e1c9544281a\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrivers/perf: hisi: hns3: Fix out-of-bound access when valid event group\\n\\nThe perf tool allows users to create event groups through following\\ncmd [1], but the driver does not check whether the array index is out\\nof bounds when writing data to the event_group array. If the number of\\nevents in an event_group is greater than HNS3_PMU_MAX_HW_EVENTS, the\\nmemory write overflow of event_group array occurs.\\n\\nAdd array index check to fix the possible array out of bounds violation,\\nand return directly when write new events are written to array bounds.\\n\\nThere are 9 different events in an event_group.\\n[1] perf stat -e \u0027{pmu/event1/, ... ,pmu/event9/}\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-11-05T09:30:04.161Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-38568\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-11-05T09:30:04.161Z\", \"dateReserved\": \"2024-06-18T19:36:34.923Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-06-19T13:35:34.925Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.