CVE-2024-35847

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-35847
In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Prevent double free on error The error handling path in its_vpe_irq_domain_alloc() causes a double free when its_vpe_init() fails after successfully allocating at least one interrupt. This happens because its_vpe_irq_domain_free() frees the interrupts along with the area bitmap and the vprop_page and its_vpe_irq_domain_alloc() subsequently frees the area bitmap and the vprop_page again. Fix this by unconditionally invoking its_vpe_irq_domain_free() which handles all cases correctly and by removing the bitmap/vprop_page freeing from its_vpe_irq_domain_alloc(). [ tglx: Massaged change log ]

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/03170e657f62c26834172742492a8cb8077ef792 Patch
https://git.kernel.org/stable/c/5b012f77abde89bf0be8a0547636184fea618137 Patch
https://git.kernel.org/stable/c/5dbdbe1133911ca7d8466bb86885adec32ad9438 Patch
https://git.kernel.org/stable/c/aa44d21574751a7d6bca892eb8e0e9ac68372e52 Patch
https://git.kernel.org/stable/c/b72d2b1448b682844f995e660b77f2a1fabc1662 Patch
https://git.kernel.org/stable/c/c26591afd33adce296c022e3480dea4282b7ef91 Patch
https://git.kernel.org/stable/c/dd681710ab77c8beafe2e263064cb1bd0e2d6ca9 Patch
https://git.kernel.org/stable/c/f5417ff561b8ac9a7e53c747b8627a7ab58378ae Patch
https://git.kernel.org/stable/c/03170e657f62c26834172742492a8cb8077ef792 Patch
https://git.kernel.org/stable/c/5b012f77abde89bf0be8a0547636184fea618137 Patch
https://git.kernel.org/stable/c/5dbdbe1133911ca7d8466bb86885adec32ad9438 Patch
https://git.kernel.org/stable/c/aa44d21574751a7d6bca892eb8e0e9ac68372e52 Patch
https://git.kernel.org/stable/c/b72d2b1448b682844f995e660b77f2a1fabc1662 Patch
https://git.kernel.org/stable/c/c26591afd33adce296c022e3480dea4282b7ef91 Patch
https://git.kernel.org/stable/c/dd681710ab77c8beafe2e263064cb1bd0e2d6ca9 Patch
https://git.kernel.org/stable/c/f5417ff561b8ac9a7e53c747b8627a7ab58378ae Patch
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html Patch
https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
History

30 Dec 2024, 17:41

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/03170e657f62c26834172742492a8cb8077ef792 - () https://git.kernel.org/stable/c/03170e657f62c26834172742492a8cb8077ef792 - Patch
References () https://git.kernel.org/stable/c/5b012f77abde89bf0be8a0547636184fea618137 - () https://git.kernel.org/stable/c/5b012f77abde89bf0be8a0547636184fea618137 - Patch
References () https://git.kernel.org/stable/c/5dbdbe1133911ca7d8466bb86885adec32ad9438 - () https://git.kernel.org/stable/c/5dbdbe1133911ca7d8466bb86885adec32ad9438 - Patch
References () https://git.kernel.org/stable/c/aa44d21574751a7d6bca892eb8e0e9ac68372e52 - () https://git.kernel.org/stable/c/aa44d21574751a7d6bca892eb8e0e9ac68372e52 - Patch
References () https://git.kernel.org/stable/c/b72d2b1448b682844f995e660b77f2a1fabc1662 - () https://git.kernel.org/stable/c/b72d2b1448b682844f995e660b77f2a1fabc1662 - Patch
References () https://git.kernel.org/stable/c/c26591afd33adce296c022e3480dea4282b7ef91 - () https://git.kernel.org/stable/c/c26591afd33adce296c022e3480dea4282b7ef91 - Patch
References () https://git.kernel.org/stable/c/dd681710ab77c8beafe2e263064cb1bd0e2d6ca9 - () https://git.kernel.org/stable/c/dd681710ab77c8beafe2e263064cb1bd0e2d6ca9 - Patch
References () https://git.kernel.org/stable/c/f5417ff561b8ac9a7e53c747b8627a7ab58378ae - () https://git.kernel.org/stable/c/f5417ff561b8ac9a7e53c747b8627a7ab58378ae - Patch
References () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html - () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html - Patch
References () https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html - () https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html - Patch
CPE cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
CWE CWE-415
First Time Debian debian Linux
Debian
Linux
Linux linux Kernel
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8

21 Nov 2024, 09:21

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html -
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html -
References () https://git.kernel.org/stable/c/03170e657f62c26834172742492a8cb8077ef792 - () https://git.kernel.org/stable/c/03170e657f62c26834172742492a8cb8077ef792 -
References () https://git.kernel.org/stable/c/5b012f77abde89bf0be8a0547636184fea618137 - () https://git.kernel.org/stable/c/5b012f77abde89bf0be8a0547636184fea618137 -
References () https://git.kernel.org/stable/c/5dbdbe1133911ca7d8466bb86885adec32ad9438 - () https://git.kernel.org/stable/c/5dbdbe1133911ca7d8466bb86885adec32ad9438 -
References () https://git.kernel.org/stable/c/aa44d21574751a7d6bca892eb8e0e9ac68372e52 - () https://git.kernel.org/stable/c/aa44d21574751a7d6bca892eb8e0e9ac68372e52 -
References () https://git.kernel.org/stable/c/b72d2b1448b682844f995e660b77f2a1fabc1662 - () https://git.kernel.org/stable/c/b72d2b1448b682844f995e660b77f2a1fabc1662 -
References () https://git.kernel.org/stable/c/c26591afd33adce296c022e3480dea4282b7ef91 - () https://git.kernel.org/stable/c/c26591afd33adce296c022e3480dea4282b7ef91 -
References () https://git.kernel.org/stable/c/dd681710ab77c8beafe2e263064cb1bd0e2d6ca9 - () https://git.kernel.org/stable/c/dd681710ab77c8beafe2e263064cb1bd0e2d6ca9 -
References () https://git.kernel.org/stable/c/f5417ff561b8ac9a7e53c747b8627a7ab58378ae - () https://git.kernel.org/stable/c/f5417ff561b8ac9a7e53c747b8627a7ab58378ae -

05 Nov 2024, 10:16

Type Values Removed Values Added
References
  • {'url': 'https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}
  • {'url': 'https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}

27 Jun 2024, 12:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html -

25 Jun 2024, 22:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html -
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: irqchip/gic-v3-its: Evitar el double free en caso de error. La ruta de manejo de errores en its_vpe_irq_domain_alloc() provoca un double free cuando its_vpe_init() falla después de asignar exitosamente al menos una interrupción. Esto sucede porque its_vpe_irq_domain_free() libera las interrupciones junto con el mapa de bits del área y la vprop_page y its_vpe_irq_domain_alloc() posteriormente libera nuevamente el mapa de bits del área y la vprop_page. Solucione este problema invocando incondicionalmente its_vpe_irq_domain_free() que maneja todos los casos correctamente y eliminando el mapa de bits/vprop_page que se libera de its_vpe_irq_domain_alloc().

17 May 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-17 15:15

Updated : 2024-12-30 17:41

NVD link : CVE-2024-35847

Mitre link : CVE-2024-35847

CVE.ORG link : CVE-2024-35847

JSON object : View

Products Affected

linux

  • linux_kernel

debian

  • debian_linux
CWE
CWE-415

Double Free