In the Linux kernel, the following vulnerability has been resolved:
mcb: fix error handling in mcb_alloc_bus()
There are two bugs: 1) If ida_simple_get() fails then this code calls put_device(carrier) but we haven't yet called get_device(carrier) and probably that leads to a use after free. 2) After device_initialize() then we need to use put_device() to release the bus. This will free the internal resources tied to the device and call mcb_free_bus() which will free the rest.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Suse | — | Upgrade dtb-apmUpgrade kernel-devel-azureUpgrade dtb-alteraUpgrade cluster-md-kmp-azureUpgrade kernel-64kbUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-default-vdsoUpgrade kernel-debug-livepatch-develUpgrade kernel-rt_debug-develUpgrade dtb-amlogicUpgrade kernel-kvmsmall-develUpgrade dtb-lgUpgrade kernel-azure-livepatch-develUpgrade cluster-md-kmp-rtUpgrade kernel-rt_debugUpgrade ocfs2-kmp-64kbUpgrade kernel-symsUpgrade kernel-zfcpdumpUpgrade kernel-64kb-livepatch-develUpgrade kernel-64kb-develUpgrade kernel-default-develUpgrade ocfs2-kmp-rtUpgrade kernel-debugUpgrade dtb-broadcomUpgrade kernel-debug-develUpgrade kernel-default-livepatchUpgrade kernel-azure-vdsoUpgrade kernel-rt_debug-vdsoUpgrade dtb-qcomUpgrade gfs2-kmp-64kbUpgrade kernel-64kb-optionalUpgrade cluster-md-kmp-defaultUpgrade kernel-rtUpgrade kernel-azure-baseUpgrade kernel-azure-optionalUpgrade kernel-docs-htmlUpgrade dtb-exynosUpgrade kernel-source-azureUpgrade dtb-xilinxUpgrade dtb-hisiliconUpgrade kernel-sourceUpgrade dtb-freescaleUpgrade kernel-syms-azureUpgrade kernel-kvmsmallUpgrade gfs2-kmp-rtUpgrade dlm-kmp-64kbUpgrade kselftests-kmp-64kbUpgrade reiserfs-kmp-64kbUpgrade kernel-default-extraUpgrade kernel-obs-qaUpgrade dtb-appleUpgrade kernel-azure-extraUpgrade kernel-azure-develUpgrade dtb-amazonUpgrade kernel-source-rtUpgrade dtb-marvellUpgrade dtb-amdUpgrade kernel-macrosUpgrade cluster-md-kmp-64kbUpgrade reiserfs-kmp-defaultUpgrade ocfs2-kmp-azureUpgrade kernel-default-optionalUpgrade kernel-azureUpgrade dlm-kmp-defaultUpgrade kernel-default-livepatch-develUpgrade kernel-syms-rtUpgrade kernel-obs-buildUpgrade ocfs2-kmp-defaultUpgrade dtb-nvidiaUpgrade kernel-rt-vdsoUpgrade dtb-sprdUpgrade dtb-caviumUpgrade kernel-docsUpgrade kernel-rt-livepatchUpgrade gfs2-kmp-azureUpgrade kselftests-kmp-rtUpgrade gfs2-kmp-defaultUpgrade kernel-64kb-extraUpgrade reiserfs-kmp-rtUpgrade kernel-rt-livepatch-develUpgrade kernel-develUpgrade dtb-renesasUpgrade dlm-kmp-azureUpgrade kernel-debug-vdsoUpgrade dlm-kmp-rtUpgrade kernel-default-baseUpgrade dtb-armUpgrade kselftests-kmp-azureUpgrade kernel-devel-rtUpgrade dtb-allwinnerUpgrade kernel-default-manUpgrade kernel-defaultUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-rt-extraUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-base-rebuildUpgrade dtb-socionextUpgrade kernel-rt-optionalUpgrade dtb-mediatekUpgrade reiserfs-kmp-azureUpgrade dtb-rockchipUpgrade kernel-source-vanillaUpgrade kselftests-kmp-defaultUpgrade kernel-rt-devel | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-ibmUpgrade linux-gcp-4.15Upgrade linux-hweUpgrade linux-azure-fipsUpgrade linux-raspiUpgrade linuxUpgrade linux-azure-4.15Upgrade linux-oracleUpgrade linux-azureUpgrade linux-awsUpgrade linux-kvmUpgrade linux-aws-5.4Upgrade linux-azure-5.4Upgrade linux-aws-hweUpgrade linux-gkeopUpgrade linux-bluefieldUpgrade linux-aws-fipsUpgrade linux-hwe-5.4Upgrade linux-raspi-5.4Upgrade linux-oracle-5.4Upgrade linux-fipsUpgrade linux-gcp-fipsUpgrade linux-gcp-5.4Upgrade linux-gcp | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub