CVE-2024-35823: vt: fix unicode buffer corruption when deleting characters

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• debian debian linux10.0
• linux linux kernel4.20 and later · before 5.4.274
• linux linux kernel5.5 and later · before 5.10.215
• linux linux kernel5.11 and later · before 5.15.154
• linux linux kernel3.7 and later · before 4.19.312
• linux linux kernel6.2 and later · before 6.6.24
• linux linux kernel6.7 and later · before 6.7.12
• linux linux kernel5.16 and later · before 6.1.84
• linux linux kernel6.8

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Linux). Independent of NVD's CPE analysis and usually ahead of it.

• Linux Linux

  • 3.7affected
  • 81732c3b2fede049a692e58a7ceabb6d18ffb18c and later · before fc7dfe3d123f00e720be80b920da287810a1f37daffected · git
  • 81732c3b2fede049a692e58a7ceabb6d18ffb18c and later · before ff7342090c1e8c5a37015c89822a68b275b46f8aaffected · git
  • 81732c3b2fede049a692e58a7ceabb6d18ffb18c and later · before 1ce408f75ccf1e25b3fddef75cca878b55f2ac90affected · git
  • 81732c3b2fede049a692e58a7ceabb6d18ffb18c and later · before 0190d19d7651c08abc187dac3819c61b726e7e3faffected · git
  • 81732c3b2fede049a692e58a7ceabb6d18ffb18c and later · before 994a1e583c0c206c8ca7d03334a65b79f4d8bc51affected · git
  • 81732c3b2fede049a692e58a7ceabb6d18ffb18c and later · before 7529cbd8b5f6697b369803fe1533612c039cabdaaffected · git
  • 81732c3b2fede049a692e58a7ceabb6d18ffb18c and later · before 2933b1e4757a0a5c689cf48d80b1a2a85f237ff1affected · git
  • 81732c3b2fede049a692e58a7ceabb6d18ffb18c and later · before 1581dafaf0d34bc9c428a794a22110d7046d186daffected · git
  • before 3.7not affected · semver

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-31431crypto: algif_aead - Revert to operating out-of-placeKEV
  90Now
• CVE-2022-0847A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe KEV
  89Now
• CVE-2021-22555Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACEKEV
  85Now

Published before and after this one in the same product

• ← EarlierCVE-2024-35813May 17, 2024 · mmc: core: Avoid negative index with array access
  22Monitor
• ← EarlierCVE-2024-35815May 17, 2024 · fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion
  22Monitor
• Later →CVE-2024-35828May 17, 2024 · wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
  22Monitor

Root cause

When data is copied, the source length is not compared with the size of the destination buffer. Excess data overwrites adjacent memory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1char buf[256];2memcpy(buf, pkt->data, pkt->len);

1char buf[256];2if (pkt->len > sizeof(buf)) {3  return -EINVAL;4}5memcpy(buf, pkt->data, pkt->len);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.