{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-38614", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-06-18T19:36:34.944Z", "datePublished": "2024-06-19T13:56:14.753Z", "dateUpdated": "2026-08-05T11:33:12.453Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:33:12.453Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nopenrisc: traps: Don't send signals to kernel mode threads\n\nOpenRISC exception handling sends signals to user processes on floating\npoint exceptions and trap instructions (for debugging) among others.\nThere is a bug where the trap handling logic may send signals to kernel\nthreads, we should not send these signals to kernel threads, if that\nhappens we treat it as an error.\n\nThis patch adds conditions to die if the kernel receives these\nexceptions in kernel mode code."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The trigger requires executing code on the target \u2014 an `rt_sigreturn` with a crafted `sigcontext.fpu.fpcsr`, a `PTRACE_SETREGSET(NT_PRFPREG)` on an own child, or an FP instruction with `FPCSR.FPEE` set. No network or adjacent-network path reaches `arch/openrisc/kernel/traps.c`.\nAC:L - The attacker fully controls the FPCSR value written to the SPR by the kernel-mode `l.mtspr` in `RESTORE_ALL`/`_switch`, so the kernel-mode exception is raised deterministically on every attempt; there is no race and no memory-layout dependence.\nPR:L - Any unprivileged local user can do this \u2014 `sigreturn` on a self-delivered signal needs no capability, and `ptrace` of one's own child needs none either; no CAP_SYS_ADMIN or root gate exists on the path into `do_fpe_trap()`/`do_trap()`.\nUI:N - The attacking process triggers the kernel-mode exception entirely on its own via a syscall return path; no other user or victim action is involved.\nS:U - The corruption and the crash are confined to the kernel of the same machine; no VM, IOMMU, or other security-authority boundary is crossed.\nC:H - `force_sig_fault()` hands userspace a kernel text address in `si_addr` (`regs->pc` of the supervisor-mode fault), and the clobbered `EPCR`/`ESR` cause the kernel to resume in supervisor mode with attacker-controlled registers and a user-controlled `r1`, from which kernel memory can be read out.\nI:H - Because the nested kernel-mode exception overwrites `EPCR`/`ESR` mid-`RESTORE_ALL`, the subsequent `l.rfe` returns into kernel code with `SR.SM` still set and the user's register file loaded, giving a supervisor-mode stack-pivot/state-corruption primitive rather than a clean fault.\nA:H - The signal is never delivered (the kernel-mode return path skips `do_work_pending`), so the faulting `mtspr` is re-executed and the exception re-fires in an unkillable supervisor-mode loop that hangs the CPU \u2014 and on the fixed kernel the same condition is a `die()`/oops."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/openrisc/kernel/traps.c"], "versions": [{"version": "27267655c5313ba0f5a3caa9ad35d887d9a12574", "lessThan": "c0ed9a711e3392d73e857faa031d8d349c0d70db", "status": "affected", "versionType": "git"}, {"version": "27267655c5313ba0f5a3caa9ad35d887d9a12574", "lessThan": "075c0405b0d7d9fc490609e988a3af0069596538", "status": "affected", "versionType": "git"}, {"version": "27267655c5313ba0f5a3caa9ad35d887d9a12574", "lessThan": "cea9d0015c140af39477dd5eeb9b20233a45daa9", "status": "affected", "versionType": "git"}, {"version": "27267655c5313ba0f5a3caa9ad35d887d9a12574", "lessThan": "c88cfb5cea5f8f9868ef02cc9ce9183a26dcf20f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/openrisc/kernel/traps.c"], "versions": [{"version": "6.4", "status": "affected"}, {"version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.33", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.12", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9.3", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.6.33"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.8.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.9.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.10"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c0ed9a711e3392d73e857faa031d8d349c0d70db"}, {"url": "https://git.kernel.org/stable/c/075c0405b0d7d9fc490609e988a3af0069596538"}, {"url": "https://git.kernel.org/stable/c/cea9d0015c140af39477dd5eeb9b20233a45daa9"}, {"url": "https://git.kernel.org/stable/c/c88cfb5cea5f8f9868ef02cc9ce9183a26dcf20f"}], "title": "openrisc: traps: Don't send signals to kernel mode threads", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:12:25.973Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/c0ed9a711e3392d73e857faa031d8d349c0d70db", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/075c0405b0d7d9fc490609e988a3af0069596538", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/cea9d0015c140af39477dd5eeb9b20233a45daa9", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/c88cfb5cea5f8f9868ef02cc9ce9183a26dcf20f", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-38614", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:12:59.093856Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:53.276Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/c0ed9a711e3392d73e857faa031d8d349c0d70db", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/075c0405b0d7d9fc490609e988a3af0069596538", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/cea9d0015c140af39477dd5eeb9b20233a45daa9", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/c88cfb5cea5f8f9868ef02cc9ce9183a26dcf20f", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:12:25.973Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-38614", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:12:59.093856Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:26.586Z"}}], "cna": {"title": "openrisc: traps: Don't send signals to kernel mode threads", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "27267655c5313ba0f5a3caa9ad35d887d9a12574", "lessThan": "c0ed9a711e3392d73e857faa031d8d349c0d70db", "versionType": "git"}, {"status": "affected", "version": "27267655c5313ba0f5a3caa9ad35d887d9a12574", "lessThan": "075c0405b0d7d9fc490609e988a3af0069596538", "versionType": "git"}, {"status": "affected", "version": "27267655c5313ba0f5a3caa9ad35d887d9a12574", "lessThan": "cea9d0015c140af39477dd5eeb9b20233a45daa9", "versionType": "git"}, {"status": "affected", "version": "27267655c5313ba0f5a3caa9ad35d887d9a12574", "lessThan": "c88cfb5cea5f8f9868ef02cc9ce9183a26dcf20f", "versionType": "git"}], "programFiles": ["arch/openrisc/kernel/traps.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.4"}, {"status": "unaffected", "version": "0", "lessThan": "6.4", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.33", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.8.12", "versionType": "semver", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9.3", "versionType": "semver", "lessThanOrEqual": "6.9.*"}, {"status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["arch/openrisc/kernel/traps.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/c0ed9a711e3392d73e857faa031d8d349c0d70db"}, {"url": "https://git.kernel.org/stable/c/075c0405b0d7d9fc490609e988a3af0069596538"}, {"url": "https://git.kernel.org/stable/c/cea9d0015c140af39477dd5eeb9b20233a45daa9"}, {"url": "https://git.kernel.org/stable/c/c88cfb5cea5f8f9868ef02cc9ce9183a26dcf20f"}], "x_generator": {"engine": "bippy-5f407fcff5a0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nopenrisc: traps: Don't send signals to kernel mode threads\n\nOpenRISC exception handling sends signals to user processes on floating\npoint exceptions and trap instructions (for debugging) among others.\nThere is a bug where the trap handling logic may send signals to kernel\nthreads, we should not send these signals to kernel threads, if that\nhappens we treat it as an error.\n\nThis patch adds conditions to die if the kernel receives these\nexceptions in kernel mode code."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-12-19T09:05:40.579Z"}}}, "cveMetadata": {"cveId": "CVE-2024-38614", "state": "PUBLISHED", "dateUpdated": "2024-12-19T09:05:40.579Z", "dateReserved": "2024-06-18T19:36:34.944Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-06-19T13:56:14.753Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/openrisc/kernel/traps.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c0ed9a711e3392d73e857faa031d8d349c0d70db", "status": "affected", "version": "27267655c5313ba0f5a3caa9ad35d887d9a12574", "versionType": "git"}, {"lessThan": "075c0405b0d7d9fc490609e988a3af0069596538", "status": "affected", "version": "27267655c5313ba0f5a3caa9ad35d887d9a12574", "versionType": "git"}, {"lessThan": "cea9d0015c140af39477dd5eeb9b20233a45daa9", "status": "affected", "version": "27267655c5313ba0f5a3caa9ad35d887d9a12574", "versionType": "git"}, {"lessThan": "c88cfb5cea5f8f9868ef02cc9ce9183a26dcf20f", "status": "affected", "version": "27267655c5313ba0f5a3caa9ad35d887d9a12574", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/openrisc/kernel/traps.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.4"}, {"lessThan": "6.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.33", "versionType": "semver"}, {"lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.12", "versionType": "semver"}, {"lessThanOrEqual": "6.9.*", "status": "unaffected", "version": "6.9.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7D9DC6CF-DE3D-4E7E-BF42-5EBCCB0F3D34", "versionEndExcluding": "6.6.33", "versionStartIncluding": "6.4", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "80550309-67AB-4FD1-AC07-3DED5C4F01B2", "versionEndExcluding": "6.8.12", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E07124C1-19E8-4D21-828D-9932A01D3011", "versionEndExcluding": "6.9.3", "versionStartIncluding": "6.9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nopenrisc: traps: Don't send signals to kernel mode threads\n\nOpenRISC exception handling sends signals to user processes on floating\npoint exceptions and trap instructions (for debugging) among others.\nThere is a bug where the trap handling logic may send signals to kernel\nthreads, we should not send these signals to kernel threads, if that\nhappens we treat it as an error.\n\nThis patch adds conditions to die if the kernel receives these\nexceptions in kernel mode code."}, {"lang": "es", "value": "En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: openrisc: trampas: no env\u00eda se\u00f1ales a subprocesos en modo kernel. El manejo de excepciones de OpenRISC env\u00eda se\u00f1ales a los procesos del usuario sobre excepciones de punto flotante e instrucciones de captura (para depuraci\u00f3n), entre otros. Hay un error en el que la l\u00f3gica de manejo de trampas puede enviar se\u00f1ales a los subprocesos del kernel. No debemos enviar estas se\u00f1ales a los subprocesos del kernel; si eso sucede, lo tratamos como un error. Este parche agrega condiciones para morir si el kernel recibe estas excepciones en el c\u00f3digo del modo kernel."}], "id": "CVE-2024-38614", "lastModified": "2026-08-04T11:18:52.677", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-38614", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T17:12:59.093856Z", "version": "2.0.3"}}]}, "published": "2024-06-19T14:15:21.240", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/075c0405b0d7d9fc490609e988a3af0069596538"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c0ed9a711e3392d73e857faa031d8d349c0d70db"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c88cfb5cea5f8f9868ef02cc9ce9183a26dcf20f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cea9d0015c140af39477dd5eeb9b20233a45daa9"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/075c0405b0d7d9fc490609e988a3af0069596538"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c0ed9a711e3392d73e857faa031d8d349c0d70db"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c88cfb5cea5f8f9868ef02cc9ce9183a26dcf20f"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cea9d0015c140af39477dd5eeb9b20233a45daa9"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: openrisc: traps: Don't send signals to kernel mode threads", "id": "2293349", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2293349"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-99", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nopenrisc: traps: Don't send signals to kernel mode threads\nOpenRISC exception handling sends signals to user processes on floating\npoint exceptions and trap instructions (for debugging) among others.\nThere is a bug where the trap handling logic may send signals to kernel\nthreads, we should not send these signals to kernel threads, if that\nhappens we treat it as an error.\nThis patch adds conditions to die if the kernel receives these\nexceptions in kernel mode code."], "name": "CVE-2024-38614", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-06-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-38614\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-38614\nhttps://lore.kernel.org/linux-cve-announce/2024061922-CVE-2024-38614-50ce@gregkh/T"], "threat_severity": "Low"}