Orta CVSS 5.5

CVE-2024-35811: Linux Kernel: serbest bırakılmış belleğin kullanımı

Yayın: 17 Mayıs 2024 17:15 · Güncelleme: 6 Kasım 2026 09:47

Açıklama (NVD)

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach This is the candidate patch of CVE-2023-47233 : https://nvd.nist.gov/vuln/detail/CVE-2023-47233 In brcm80211 driver,it starts with the following invoking chain to start init a timeout worker: ->brcmf_usb_probe ->brcmf_usb_probe_cb ->brcmf_attach ->brcmf_bus_started ->brcmf_cfg80211_attach ->wl_init_priv ->brcmf_init_escan ->INIT_WORK(&cfg->escan_timeout_work, brcmf_cfg80211_escan_timeout_worker); If we disconnect the USB by hotplug, it will call brcmf_usb_disconnect to make cleanup. The invoking chain is : brcmf_usb_disconnect ->brcmf_usb_disconnect_cb ->brcmf_detach ->brcmf_cfg80211_detach ->kfree(cfg); While the timeout woker may still be running. This will cause a use-after-free bug on cfg in brcmf_cfg80211_escan_timeout_worker. Fix it by deleting the timer and canceling the worker in brcmf_cfg80211_detach. [arend.vanspriel@broadcom.com: keep timer delete as is and cancel work just before free]

Özet bilgiler

Ürün: Linux Linux Kernel
CVSS v3.1: 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS: %0,35 (yüzdelik 29)
CWE: CWE-416
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
linux-linux-kernel	3.7	—	4.19.312
linux-linux-kernel	4.20	—	5.4.274
linux-linux-kernel	5.5	—	5.10.215
linux-linux-kernel	5.11	—	5.15.154
linux-linux-kernel	5.16	—	6.1.84
linux-linux-kernel	6.2	—	6.6.24
linux-linux-kernel	6.7	—	6.7.12
linux-linux-kernel	6.8	—	6.8.3
debian-debian-linux	10.0	10.0	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları