CVE-2024-50269

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-50269
In the Linux kernel, the following vulnerability has been resolved: usb: musb: sunxi: Fix accessing an released usb phy Commit 6ed05c68cbca ("usb: musb: sunxi: Explicitly release USB PHY on exit") will cause that usb phy @glue->xceiv is accessed after released. 1) register platform driver @sunxi_musb_driver // get the usb phy @glue->xceiv sunxi_musb_probe() -> devm_usb_get_phy(). 2) register and unregister platform driver @musb_driver musb_probe() -> sunxi_musb_init() use the phy here //the phy is released here musb_remove() -> sunxi_musb_exit() -> devm_usb_put_phy() 3) register @musb_driver again musb_probe() -> sunxi_musb_init() use the phy here but the phy has been released at 2). ... Fixed by reverting the commit, namely, removing devm_usb_put_phy() from sunxi_musb_exit().

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/498dbd9aea205db9da674994b74c7bf8e18448bd Patch
https://git.kernel.org/stable/c/4aa77d5ea9944468e16c3eed15e858fd5de44de1 Patch
https://git.kernel.org/stable/c/63559ba8077cbadae1c92a65b73ea522bf377dd9 Patch
https://git.kernel.org/stable/c/6e2848d1c8c0139161e69ac0a94133e90e9988e8 Patch
https://git.kernel.org/stable/c/721ddad945596220c123eb6f7126729fe277ee4f Patch
https://git.kernel.org/stable/c/8a30da5aa9609663b3e05bcc91a916537f66a4cd Patch
https://git.kernel.org/stable/c/b08baa75b989cf779cbfa0969681f8ba2dc46569 Patch
https://git.kernel.org/stable/c/ccd811c304d2ee56189bfbc49302cb3c44361893 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc6:*:*:*:*:*:*
History

26 Nov 2024, 22:30

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/498dbd9aea205db9da674994b74c7bf8e18448bd - () https://git.kernel.org/stable/c/498dbd9aea205db9da674994b74c7bf8e18448bd - Patch
References () https://git.kernel.org/stable/c/4aa77d5ea9944468e16c3eed15e858fd5de44de1 - () https://git.kernel.org/stable/c/4aa77d5ea9944468e16c3eed15e858fd5de44de1 - Patch
References () https://git.kernel.org/stable/c/63559ba8077cbadae1c92a65b73ea522bf377dd9 - () https://git.kernel.org/stable/c/63559ba8077cbadae1c92a65b73ea522bf377dd9 - Patch
References () https://git.kernel.org/stable/c/6e2848d1c8c0139161e69ac0a94133e90e9988e8 - () https://git.kernel.org/stable/c/6e2848d1c8c0139161e69ac0a94133e90e9988e8 - Patch
References () https://git.kernel.org/stable/c/721ddad945596220c123eb6f7126729fe277ee4f - () https://git.kernel.org/stable/c/721ddad945596220c123eb6f7126729fe277ee4f - Patch
References () https://git.kernel.org/stable/c/8a30da5aa9609663b3e05bcc91a916537f66a4cd - () https://git.kernel.org/stable/c/8a30da5aa9609663b3e05bcc91a916537f66a4cd - Patch
References () https://git.kernel.org/stable/c/b08baa75b989cf779cbfa0969681f8ba2dc46569 - () https://git.kernel.org/stable/c/b08baa75b989cf779cbfa0969681f8ba2dc46569 - Patch
References () https://git.kernel.org/stable/c/ccd811c304d2ee56189bfbc49302cb3c44361893 - () https://git.kernel.org/stable/c/ccd811c304d2ee56189bfbc49302cb3c44361893 - Patch
CPE cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*
First Time Linux
Linux linux Kernel
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CWE CWE-416

19 Nov 2024, 21:57

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: usb: musb: sunxi: Se solucionó el acceso a un usb phy liberado. Commit 6ed05c68cbca ("usb: musb: sunxi: Liberar explícitamente USB PHY al salir") provocará que se acceda al usb phy @glue->xceiv después de su liberación. 1) registrar el controlador de la plataforma @sunxi_musb_driver // obtener el usb phy @glue->xceiv sunxi_musb_probe() -> devm_usb_get_phy(). 2) registrar y anular el registro del controlador de la plataforma @musb_driver musb_probe() -> sunxi_musb_init() usa el phy aquí //el phy se publica aquí musb_remove() -> sunxi_musb_exit() -> devm_usb_put_phy() 3) registrar @musb_driver nuevamente musb_probe() -> sunxi_musb_init() usa el phy aquí pero el phy se ha publicado en 2). ... Se solucionó revirtiendo el commit, es decir, eliminando devm_usb_put_phy() de sunxi_musb_exit().

19 Nov 2024, 02:16

Type Values Removed Values Added
New CVE
Information

Published : 2024-11-19 02:16

Updated : 2024-11-26 22:30

NVD link : CVE-2024-50269

Mitre link : CVE-2024-50269

CVE.ORG link : CVE-2024-50269

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free