CVE-2024-47666

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-47666
In the Linux kernel, the following vulnerability has been resolved: scsi: pm80xx: Set phy->enable_completion only when we wait for it pm8001_phy_control() populates the enable_completion pointer with a stack address, sends a PHY_LINK_RESET / PHY_HARD_RESET, waits 300 ms, and returns. The problem arises when a phy control response comes late. After 300 ms the pm8001_phy_control() function returns and the passed enable_completion stack address is no longer valid. Late phy control response invokes complete() on a dangling enable_completion pointer which leads to a kernel crash.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/7b1d779647afaea9185fa2f150b1721e7c1aae89 Patch
https://git.kernel.org/stable/c/e4f949ef1516c0d74745ee54a0f4882c1f6c7aea Patch
https://git.kernel.org/stable/c/f14d3e1aa613311c744af32d75125e95fc8ffb84 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

23 Oct 2024, 16:34

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/7b1d779647afaea9185fa2f150b1721e7c1aae89 - () https://git.kernel.org/stable/c/7b1d779647afaea9185fa2f150b1721e7c1aae89 - Patch
References () https://git.kernel.org/stable/c/e4f949ef1516c0d74745ee54a0f4882c1f6c7aea - () https://git.kernel.org/stable/c/e4f949ef1516c0d74745ee54a0f4882c1f6c7aea - Patch
References () https://git.kernel.org/stable/c/f14d3e1aa613311c744af32d75125e95fc8ffb84 - () https://git.kernel.org/stable/c/f14d3e1aa613311c744af32d75125e95fc8ffb84 - Patch
CWE CWE-416
First Time Linux linux Kernel
Linux

10 Oct 2024, 12:51

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: scsi: pm80xx: Establecer phy->enable_completion solo cuando lo esperamos pm8001_phy_control() rellena el puntero enable_completion con una dirección de pila, envía un PHY_LINK_RESET / PHY_HARD_RESET, espera 300 ms y regresa. El problema surge cuando una respuesta de control phy llega tarde. Después de 300 ms, la función pm8001_phy_control() regresa y la dirección de pila enable_completion pasada ya no es válida. La respuesta de control phy tardía invoca complete() en un puntero enable_completion colgante que conduce a un bloqueo del kernel.

09 Oct 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-10-09 15:15

Updated : 2024-10-23 16:34

NVD link : CVE-2024-47666

Mitre link : CVE-2024-47666

CVE.ORG link : CVE-2024-47666

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free