CVE-2024-35992

What it actually does

Out-of-bounds read in the Marvell A3700 comphy PHY driver when iterating past ARRAY_SIZE(gbe_phy_init_fix), causing invalid memory access to gbe_phy_init_fix[fix_idx].addr after the array is exhausted.

Why it matters to the business

Potential system instability or denial of service on Linux systems using the affected Marvell PHY hardware; low likelihood of remote exploitation reduces immediate operational risk but still requires patching to maintain kernel integrity.

How an attack unfolds

An attacker with local access triggers the PHY initialization routine in the a3700-comphy driver; once fix_idx exceeds the array bounds the kernel reads beyond the allocated structure, which can be leveraged for memory disclosure or to induce a crash in environments where the comphy is exercised during boot or interface bring-up.

How to fix it

Update the Linux kernel to a version containing commit 976df695f579bbb2914114b4e9974fe4ed1eb813 or later; rebuild and deploy the fixed kernel image on all affected systems.

How to confirm the fix worked

Verify the presence of commit 976df695f579bbb2914114b4e9974fe4ed1eb813 in the kernel source tree or confirm the running kernel version includes the corrected a3700-comphy.c driver logic that checks ARRAY_SIZE before accessing gbe_phy_init_fix.

Typical attack path

1. Obtain local code execution or shell access on the target Linux system
2. Force repeated PHY initialization or interface configuration that exercises gbe_phy_init_fix iteration
3. Trigger the loop until fix_idx surpasses ARRAY_SIZE(gbe_phy_init_fix)
4. Read or dereference the out-of-bounds address leading to kernel fault or information leak

How to detect it

Review kernel ring buffer and dmesg output for oops traces mentioning a3700_comphy or gbe_phy_init_fix; correlate with process activity that brings up network interfaces on affected hardware.

What your security team should do

• Apply the referenced kernel commit or newer stable release immediately on all systems using Marvell A3700 comphy hardware
• Monitor kernel logs for oops or panic messages related to a3700-comphy during boot and interface configuration
• Prioritize systems with local untrusted user access for earliest patching