In the Linux kernel, the following vulnerability has been resolved:
usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable()
... cdns3_gadget_ep_free_request(&priv_ep->endpoint, &priv_req->request); list_del_init(&priv_req->list); ...
'priv_req' actually free at cdns3_gadget_ep_free_request(). But list_del_init() use priv_req->list after it.
[ 1542.642868][ T534] BUG: KFENCE: use-after-free read in __list_del_entry_valid+0x10/0xd4 [ 1542.642868][ T534] [ 1542.653162][ T534] Use-after-free read at 0x000000009ed0ba99 (in kfence-#3): [ 1542.660311][ T534] __list_del_entry_valid+0x10/0xd4 [ 1542.665375][ T534] cdns3_gadget_ep_disable+0x1f8/0x388 [cdns3] [ 1542.671571][ T534] usb_ep_disable+0x44/0xe4 [ 1542.675948][ T534] ffs_func_eps_disable+0x64/0xc8 [ 1542.680839][ T534] ffs_func_set_alt+0x74/0x368 [ 1542.685478][ T534] ffs_func_disable+0x18/0x28
Move list_del_init() before cdns3_gadget_ep_free_request() to resolve this problem.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | May 8, 2024 | Apr 3, 2024 |
| Suse | — | Upgrade reiserfs-kmp-azureUpgrade dtb-nvidiaUpgrade dtb-amlogicUpgrade kernel-debug-livepatch-develUpgrade kernel-rt-livepatch-develUpgrade dtb-amdUpgrade dtb-mediatekUpgrade kselftests-kmp-defaultUpgrade kernel-devel-rtUpgrade kernel-debugUpgrade dtb-xilinxUpgrade kernel-azure-vdsoUpgrade dtb-socionextUpgrade dlm-kmp-defaultUpgrade dtb-renesasUpgrade kernel-syms-rtUpgrade dlm-kmp-rtUpgrade kernel-docsUpgrade kselftests-kmp-rtUpgrade dlm-kmp-azureUpgrade dtb-rockchipUpgrade kernel-defaultUpgrade dtb-hisiliconUpgrade kernel-64kb-livepatch-develUpgrade dtb-apmUpgrade kernel-azure-livepatch-develUpgrade kernel-default-base-rebuildUpgrade kernel-default-livepatch-develUpgrade kernel-azure-develUpgrade kernel-macrosUpgrade kernel-obs-qaUpgrade kernel-64kb-develUpgrade kernel-rt-develUpgrade cluster-md-kmp-64kbUpgrade gfs2-kmp-64kbUpgrade gfs2-kmp-rtUpgrade kernel-rt_debugUpgrade dtb-armUpgrade kernel-default-extraUpgrade cluster-md-kmp-defaultUpgrade kernel-symsUpgrade kernel-rt_debug-vdsoUpgrade ocfs2-kmp-rtUpgrade reiserfs-kmp-rtUpgrade kernel-default-baseUpgrade kernel-kvmsmallUpgrade kselftests-kmp-64kbUpgrade kernel-kvmsmall-develUpgrade kernel-devel-azureUpgrade ocfs2-kmp-64kbUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-exynosUpgrade kernel-syms-azureUpgrade kernel-azureUpgrade kernel-kvmsmall-vdsoUpgrade kernel-debug-develUpgrade kernel-64kbUpgrade dtb-lgUpgrade dlm-kmp-64kbUpgrade kernel-source-vanillaUpgrade dtb-qcomUpgrade kernel-default-vdsoUpgrade kernel-azure-extraUpgrade cluster-md-kmp-azureUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-rtUpgrade dtb-caviumUpgrade kernel-obs-buildUpgrade kernel-64kb-extraUpgrade dtb-marvellUpgrade kernel-rt-vdsoUpgrade kernel-rt-livepatchUpgrade kernel-develUpgrade kernel-source-azureUpgrade ocfs2-kmp-azureUpgrade kernel-rt-optionalUpgrade kselftests-kmp-azureUpgrade kernel-azure-optionalUpgrade gfs2-kmp-azureUpgrade cluster-md-kmp-rtUpgrade kernel-default-optionalUpgrade kernel-default-develUpgrade reiserfs-kmp-64kbUpgrade kernel-docs-htmlUpgrade kernel-rt_debug-develUpgrade dtb-freescaleUpgrade kernel-debug-vdsoUpgrade gfs2-kmp-defaultUpgrade dtb-alteraUpgrade dtb-appleUpgrade kernel-default-livepatchUpgrade kernel-sourceUpgrade dtb-broadcomUpgrade kernel-source-rtUpgrade kernel-64kb-optionalUpgrade dtb-sprdUpgrade dtb-amazonUpgrade dtb-allwinnerUpgrade reiserfs-kmp-defaultUpgrade ocfs2-kmp-defaultUpgrade kernel-zfcpdumpUpgrade kernel-rt-extra | May 6, 2024 | Apr 3, 2024 |
| Ubuntu | — | Upgrade linux-image-5.4.0-1086-bluefieldUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-ibmUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-genericUpgrade linux-image-oracleUpgrade linux-image-azure-lts-20.04Upgrade linux-image-oem-20.04Upgrade linux-image-ibm-lts-20.04Upgrade linux-image-5.15.0-1060-gkeUpgrade linux-image-gke-5.15Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-5.15.0-110-lowlatency-64kUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-5.15.0-1058-nvidiaUpgrade linux-image-azure-lts-22.04Upgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-5.15.0-1066-azureUpgrade linux-image-gkeopUpgrade linux-image-5.15.0-113-generic-64kUpgrade linux-image-5.15.0-113-genericUpgrade linux-image-raspi-nolpaeUpgrade linux-image-gkeop-5.4Upgrade linux-image-5.4.0-1130-gcpUpgrade linux-image-5.4.0-1110-raspiUpgrade linux-image-oemUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-5.15.0-1062-gcpUpgrade linux-image-bluefieldUpgrade linux-image-generic-lpaeUpgrade linux-image-5.15.0-1058-intel-iotgUpgrade linux-image-aws-lts-20.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-5.15.0-1061-oracleUpgrade linux-image-oem-20.04bUpgrade linux-image-gkeUpgrade linux-image-nvidiaUpgrade linux-image-5.4.0-186-genericUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-5.4.0-1131-azureUpgrade linux-image-5.15.0-1058-raspiUpgrade linux-image-5.15.0-1060-kvmUpgrade linux-image-lowlatencyUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-5.15.0-1030-xilinx-zynqmpUpgrade linux-image-5.15.0-1063-awsUpgrade linux-image-5.4.0-1045-xilinx-zynqmpUpgrade linux-image-5.15.0-1065-azure-fdeUpgrade linux-image-kvmUpgrade linux-image-generic-64kUpgrade linux-image-5.15.0-110-lowlatencyUpgrade linux-image-5.15.0-1056-ibmUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-gcpUpgrade linux-image-raspi2Upgrade linux-image-oem-osp1Upgrade linux-image-aws-lts-22.04Upgrade linux-image-5.4.0-1126-awsUpgrade linux-image-5.15.0-112-generic-64kUpgrade linux-image-5.4.0-1114-kvmUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-5.4.0-186-lowlatencyUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-5.4.0-1093-gkeopUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-5.15.0-112-generic-lpaeUpgrade linux-image-5.15.0-1046-gkeopUpgrade linux-image-oem-20.04cUpgrade linux-image-intelUpgrade linux-image-5.15.0-1058-nvidia-lowlatencyUpgrade linux-image-awsUpgrade linux-image-azureUpgrade linux-image-raspiUpgrade linux-image-5.15.0-112-genericUpgrade linux-image-intel-iotgUpgrade linux-image-5.4.0-1073-ibmUpgrade linux-image-5.15.0-113-generic-lpaeUpgrade linux-image-virtualUpgrade linux-image-5.15.0-1057-ibmUpgrade linux-image-5.4.0-1038-iotUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-oem-20.04dUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-5.4.0-1125-oracleUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-5.4.0-186-generic-lpaeUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-gkeop-5.15 | Jul 1, 2024 | Apr 3, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 3, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub