In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: fix potential use-after-free in ec_bhf_remove
static void ec_bhf_remove(struct pci_dev *dev) { ... struct ec_bhf_priv *priv = netdev_priv(net_dev);
unregister_netdev(net_dev); free_netdev(net_dev);
pci_iounmap(dev, priv->dma_io); pci_iounmap(dev, priv->io); ... }
priv is netdev private data, but it is used after free_netdev(). It can cause use-after-free when accessing priv pointer. So, fix it by moving free_netdev() after pci_iounmap() calls.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Suse | — | Upgrade kernel-azure-baseUpgrade kernel-defaultUpgrade reiserfs-kmp-defaultUpgrade kernel-develUpgrade kernel-default-baseUpgrade kernel-preempt-develUpgrade kernel-azureUpgrade kernel-obs-buildUpgrade kernel-docsUpgrade kernel-zfcpdumpUpgrade kernel-source-azureUpgrade kernel-default-develUpgrade kernel-devel-azureUpgrade kernel-symsUpgrade kernel-azure-develUpgrade kernel-preemptUpgrade kernel-default-extraUpgrade kernel-syms-azureUpgrade kernel-sourceUpgrade kernel-default-manUpgrade kernel-64kbUpgrade kernel-64kb-develUpgrade kernel-macros | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-image-4.4.0-1143-kvmUpgrade linux-image-4.4.0-267-genericUpgrade linux-image-4.4.0-1180-awsUpgrade linux-image-fipsUpgrade linux-image-genericUpgrade linux-image-generic-lts-xenialUpgrade linux-image-lowlatencyUpgrade linux-image-4.4.0-1142-awsUpgrade linux-image-4.4.0-1112-fipsUpgrade linux-image-awsUpgrade linux-image-virtualUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-4.4.0-267-lowlatencyUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-kvm | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub