CVE-2024-35944

In the Linux kernel, the following vulnerability has been resolved:

VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()

The Linux kernel CVE team has assigned CVE-2024-35944 to this issue.

Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051920-CVE-2024-35944-a860@gregkh/T

This vulnerability is rated with a Low severity because it requires local access to interact with the VMware VMCI interface and primarily triggers a fortification runtime check rather than causing arbitrary out-of-bounds memory corruption. Exposure is restricted to virtualized environments running on VMware platforms where the VMCI driver is actively loaded. Because the flaw involves copying datagram contents across contiguous structure members into an adjacent flexible array buffer, the operational blast radius is limited to kernel diagnostic warnings or a potential local denial of service under fortified kernel configurations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.