CVE-2024-36940

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-36940
In the Linux kernel, the following vulnerability has been resolved: pinctrl: core: delete incorrect free in pinctrl_enable() The "pctldev" struct is allocated in devm_pinctrl_register_and_init(). It's a devm_ managed pointer that is freed by devm_pinctrl_dev_release(), so freeing it in pinctrl_enable() will lead to a double free. The devm_pinctrl_dev_release() function frees the pindescs and destroys the mutex as well.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/288bc4aa75f150d6f1ee82dd43c6da1b438b6068 Patch
https://git.kernel.org/stable/c/41f88ef8ba387a12f4a2b8c400b6c9e8e54b2cca Patch
https://git.kernel.org/stable/c/5038a66dad0199de60e5671603ea6623eb9e5c79 Patch
https://git.kernel.org/stable/c/558c8039fdf596a584a92c171cbf3298919c448c Patch
https://git.kernel.org/stable/c/735f4c6b6771eafe336404c157ca683ad72a040d Patch
https://git.kernel.org/stable/c/ac7d65795827dc0cf7662384ed27caf4066bd72e Patch
https://git.kernel.org/stable/c/cdaa171473d98962ae86f2a663d398fda2fbeefd Patch
https://git.kernel.org/stable/c/f9f1e321d53e4c5b666b66e5b43da29841fb55ba Patch
https://git.kernel.org/stable/c/288bc4aa75f150d6f1ee82dd43c6da1b438b6068 Patch
https://git.kernel.org/stable/c/41f88ef8ba387a12f4a2b8c400b6c9e8e54b2cca Patch
https://git.kernel.org/stable/c/5038a66dad0199de60e5671603ea6623eb9e5c79 Patch
https://git.kernel.org/stable/c/558c8039fdf596a584a92c171cbf3298919c448c Patch
https://git.kernel.org/stable/c/735f4c6b6771eafe336404c157ca683ad72a040d Patch
https://git.kernel.org/stable/c/ac7d65795827dc0cf7662384ed27caf4066bd72e Patch
https://git.kernel.org/stable/c/cdaa171473d98962ae86f2a663d398fda2fbeefd Patch
https://git.kernel.org/stable/c/f9f1e321d53e4c5b666b66e5b43da29841fb55ba Patch
https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html Mailing List
https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html Mailing List
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc6:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
History

10 Jan 2025, 18:29

Type Values Removed Values Added
CWE CWE-415
References () https://git.kernel.org/stable/c/288bc4aa75f150d6f1ee82dd43c6da1b438b6068 - () https://git.kernel.org/stable/c/288bc4aa75f150d6f1ee82dd43c6da1b438b6068 - Patch
References () https://git.kernel.org/stable/c/41f88ef8ba387a12f4a2b8c400b6c9e8e54b2cca - () https://git.kernel.org/stable/c/41f88ef8ba387a12f4a2b8c400b6c9e8e54b2cca - Patch
References () https://git.kernel.org/stable/c/5038a66dad0199de60e5671603ea6623eb9e5c79 - () https://git.kernel.org/stable/c/5038a66dad0199de60e5671603ea6623eb9e5c79 - Patch
References () https://git.kernel.org/stable/c/558c8039fdf596a584a92c171cbf3298919c448c - () https://git.kernel.org/stable/c/558c8039fdf596a584a92c171cbf3298919c448c - Patch
References () https://git.kernel.org/stable/c/735f4c6b6771eafe336404c157ca683ad72a040d - () https://git.kernel.org/stable/c/735f4c6b6771eafe336404c157ca683ad72a040d - Patch
References () https://git.kernel.org/stable/c/ac7d65795827dc0cf7662384ed27caf4066bd72e - () https://git.kernel.org/stable/c/ac7d65795827dc0cf7662384ed27caf4066bd72e - Patch
References () https://git.kernel.org/stable/c/cdaa171473d98962ae86f2a663d398fda2fbeefd - () https://git.kernel.org/stable/c/cdaa171473d98962ae86f2a663d398fda2fbeefd - Patch
References () https://git.kernel.org/stable/c/f9f1e321d53e4c5b666b66e5b43da29841fb55ba - () https://git.kernel.org/stable/c/f9f1e321d53e4c5b666b66e5b43da29841fb55ba - Patch
References () https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html - () https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html - Mailing List
References () https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html - () https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html - Mailing List
First Time Debian debian Linux
Debian
Linux
Linux linux Kernel
CPE cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8

21 Nov 2024, 09:22

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html -
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html -
References () https://git.kernel.org/stable/c/288bc4aa75f150d6f1ee82dd43c6da1b438b6068 - () https://git.kernel.org/stable/c/288bc4aa75f150d6f1ee82dd43c6da1b438b6068 -
References () https://git.kernel.org/stable/c/41f88ef8ba387a12f4a2b8c400b6c9e8e54b2cca - () https://git.kernel.org/stable/c/41f88ef8ba387a12f4a2b8c400b6c9e8e54b2cca -
References () https://git.kernel.org/stable/c/5038a66dad0199de60e5671603ea6623eb9e5c79 - () https://git.kernel.org/stable/c/5038a66dad0199de60e5671603ea6623eb9e5c79 -
References () https://git.kernel.org/stable/c/558c8039fdf596a584a92c171cbf3298919c448c - () https://git.kernel.org/stable/c/558c8039fdf596a584a92c171cbf3298919c448c -
References () https://git.kernel.org/stable/c/735f4c6b6771eafe336404c157ca683ad72a040d - () https://git.kernel.org/stable/c/735f4c6b6771eafe336404c157ca683ad72a040d -
References () https://git.kernel.org/stable/c/ac7d65795827dc0cf7662384ed27caf4066bd72e - () https://git.kernel.org/stable/c/ac7d65795827dc0cf7662384ed27caf4066bd72e -
References () https://git.kernel.org/stable/c/cdaa171473d98962ae86f2a663d398fda2fbeefd - () https://git.kernel.org/stable/c/cdaa171473d98962ae86f2a663d398fda2fbeefd -
References () https://git.kernel.org/stable/c/f9f1e321d53e4c5b666b66e5b43da29841fb55ba - () https://git.kernel.org/stable/c/f9f1e321d53e4c5b666b66e5b43da29841fb55ba -

05 Nov 2024, 10:17

Type Values Removed Values Added
References
  • {'url': 'https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}
  • {'url': 'https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}

27 Jun 2024, 14:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html -

27 Jun 2024, 12:15

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: pinctrl: core: eliminar incorrecto gratis en pinctrl_enable() La estructura "pctldev" está asignada en devm_pinctrl_register_and_init(). Es un puntero administrado por devm_ que se libera mediante devm_pinctrl_dev_release(), por lo que liberarlo en pinctrl_enable() generará una doble liberación. La función devm_pinctrl_dev_release() libera los pindescs y también destruye el mutex.
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html -

30 May 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-30 16:15

Updated : 2025-01-10 18:29

NVD link : CVE-2024-36940

Mitre link : CVE-2024-36940

CVE.ORG link : CVE-2024-36940

JSON object : View

Products Affected

debian

  • debian_linux

linux

  • linux_kernel
CWE
CWE-415

Double Free