In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: fix potential use-after-free in ec_bhf_remove
static void ec_bhf_remove(struct pci_dev *dev) { ... struct ec_bhf_priv *priv = netdev_priv(net_dev);
unregister_netdev(net_dev); free_netdev(net_dev);
pci_iounmap(dev, priv->dma_io); pci_iounmap(dev, priv->io); ... }
priv is netdev private data, but it is used after free_netdev(). It can cause use-after-free when accessing priv pointer. So, fix it by moving free_netdev() after pci_iounmap() calls.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Suse | — | Upgrade kernel-zfcpdumpUpgrade kernel-devel-azureUpgrade kernel-syms-azureUpgrade kernel-64kb-develUpgrade kernel-sourceUpgrade kernel-default-extraUpgrade kernel-default-develUpgrade kernel-symsUpgrade kernel-azure-develUpgrade kernel-macrosUpgrade kernel-preemptUpgrade kernel-64kbUpgrade kernel-default-manUpgrade kernel-source-azureUpgrade kernel-azureUpgrade kernel-defaultUpgrade kernel-azure-baseUpgrade kernel-default-baseUpgrade kernel-develUpgrade reiserfs-kmp-defaultUpgrade kernel-obs-buildUpgrade kernel-preempt-develUpgrade kernel-docs | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-image-4.4.0-267-lowlatencyUpgrade linux-image-4.4.0-1142-awsUpgrade linux-image-virtualUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-kvmUpgrade linux-image-4.4.0-1112-fipsUpgrade linux-image-awsUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-fipsUpgrade linux-image-generic-lts-xenialUpgrade linux-image-4.4.0-1143-kvmUpgrade linux-image-genericUpgrade linux-image-lowlatencyUpgrade linux-image-4.4.0-1180-awsUpgrade linux-image-4.4.0-267-generic | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub