In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: fix potential use-after-free in ec_bhf_remove
static void ec_bhf_remove(struct pci_dev *dev) { ... struct ec_bhf_priv *priv = netdev_priv(net_dev);
unregister_netdev(net_dev); free_netdev(net_dev);
pci_iounmap(dev, priv->dma_io); pci_iounmap(dev, priv->io); ... }
priv is netdev private data, but it is used after free_netdev(). It can cause use-after-free when accessing priv pointer. So, fix it by moving free_netdev() after pci_iounmap() calls.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Suse | — | Upgrade kernel-sourceUpgrade kernel-macrosUpgrade kernel-64kbUpgrade kernel-zfcpdumpUpgrade kernel-default-develUpgrade kernel-preemptUpgrade kernel-symsUpgrade kernel-syms-azureUpgrade kernel-64kb-develUpgrade kernel-source-azureUpgrade kernel-default-manUpgrade kernel-devel-azureUpgrade kernel-azure-develUpgrade kernel-default-extraUpgrade kernel-defaultUpgrade kernel-azureUpgrade kernel-default-baseUpgrade kernel-azure-baseUpgrade kernel-obs-buildUpgrade kernel-docsUpgrade kernel-develUpgrade kernel-preempt-develUpgrade reiserfs-kmp-default | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-image-virtual-lts-xenialUpgrade linux-image-kvmUpgrade linux-image-4.4.0-267-lowlatencyUpgrade linux-image-4.4.0-1112-fipsUpgrade linux-image-awsUpgrade linux-image-4.4.0-1142-awsUpgrade linux-image-virtualUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-generic-lts-xenialUpgrade linux-image-fipsUpgrade linux-image-4.4.0-267-genericUpgrade linux-image-4.4.0-1180-awsUpgrade linux-image-lowlatencyUpgrade linux-image-4.4.0-1143-kvmUpgrade linux-image-generic | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub