CVE-2024-58063

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-58063
In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: fix memory leaks and invalid access at probe error path Deinitialize at reverse order when probe fails. When init_sw_vars fails, rtl_deinit_core should not be called, specially now that it destroys the rtl_wq workqueue. And call rtl_pci_deinit and deinit_sw_vars, otherwise, memory will be leaked. Remove pci_set_drvdata call as it will already be cleaned up by the core driver code and could lead to memory leaks too. cf. commit 8d450935ae7f ("wireless: rtlwifi: remove unnecessary pci_set_drvdata()") and commit 3d86b93064c7 ("rtlwifi: Fix PCI probe error path orphaned memory").

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/32acebca0a51f5e372536bfdc0d7d332ab749013 Patch
https://git.kernel.org/stable/c/455e0f40b5352186a9095f2135d5c89255e7c39a Patch
https://git.kernel.org/stable/c/624cea89a0865a2bc3e00182a6b0f954a94328b4 Patch
https://git.kernel.org/stable/c/6b76bab5c257463302c9e97f5d84d524457468eb Patch
https://git.kernel.org/stable/c/85b67b4c4a0f8a6fb20cf4ef7684ff2b0cf559df Patch
https://git.kernel.org/stable/c/b96371339fd9cac90f5ee4ac17ee5c4cbbdfa6f7 Patch
https://git.kernel.org/stable/c/e7ceefbfd8d447abc8aca8ab993a942803522c06 Patch
https://git.kernel.org/stable/c/ee0b0d7baa8a6d42c7988f6e50c8f164cdf3fa47 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

25 Mar 2025, 14:37

Type Values Removed Values Added
CWE CWE-401
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
References () https://git.kernel.org/stable/c/32acebca0a51f5e372536bfdc0d7d332ab749013 - () https://git.kernel.org/stable/c/32acebca0a51f5e372536bfdc0d7d332ab749013 - Patch
References () https://git.kernel.org/stable/c/455e0f40b5352186a9095f2135d5c89255e7c39a - () https://git.kernel.org/stable/c/455e0f40b5352186a9095f2135d5c89255e7c39a - Patch
References () https://git.kernel.org/stable/c/624cea89a0865a2bc3e00182a6b0f954a94328b4 - () https://git.kernel.org/stable/c/624cea89a0865a2bc3e00182a6b0f954a94328b4 - Patch
References () https://git.kernel.org/stable/c/6b76bab5c257463302c9e97f5d84d524457468eb - () https://git.kernel.org/stable/c/6b76bab5c257463302c9e97f5d84d524457468eb - Patch
References () https://git.kernel.org/stable/c/85b67b4c4a0f8a6fb20cf4ef7684ff2b0cf559df - () https://git.kernel.org/stable/c/85b67b4c4a0f8a6fb20cf4ef7684ff2b0cf559df - Patch
References () https://git.kernel.org/stable/c/b96371339fd9cac90f5ee4ac17ee5c4cbbdfa6f7 - () https://git.kernel.org/stable/c/b96371339fd9cac90f5ee4ac17ee5c4cbbdfa6f7 - Patch
References () https://git.kernel.org/stable/c/e7ceefbfd8d447abc8aca8ab993a942803522c06 - () https://git.kernel.org/stable/c/e7ceefbfd8d447abc8aca8ab993a942803522c06 - Patch
References () https://git.kernel.org/stable/c/ee0b0d7baa8a6d42c7988f6e50c8f164cdf3fa47 - () https://git.kernel.org/stable/c/ee0b0d7baa8a6d42c7988f6e50c8f164cdf3fa47 - Patch
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
First Time Linux
Linux linux Kernel

13 Mar 2025, 13:15

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: rtlwifi: corrige fugas de memoria y acceso no válido en la ruta de error de la sonda Desinicializar en orden inverso cuando la sonda falla. Cuando init_sw_vars falla, no se debe llamar a rtl_deinit_core, especialmente ahora que destruye la cola de trabajo rtl_wq. Y llame a rtl_pci_deinit y deinit_sw_vars, de lo contrario, se perderá memoria. Elimine la llamada a pci_set_drvdata ya que ya estará limpiada por el código del controlador central y también podría provocar fugas de memoria. cf. commit 8d450935ae7f ("wireless: rtlwifi: eliminar pci_set_drvdata() innecesario") y commit 3d86b93064c7 ("rtlwifi: corregir la memoria huérfana en la ruta de error de la sonda PCI").
References
  • () https://git.kernel.org/stable/c/455e0f40b5352186a9095f2135d5c89255e7c39a -
  • () https://git.kernel.org/stable/c/85b67b4c4a0f8a6fb20cf4ef7684ff2b0cf559df -
  • () https://git.kernel.org/stable/c/b96371339fd9cac90f5ee4ac17ee5c4cbbdfa6f7 -

06 Mar 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-06 16:15

Updated : 2025-03-25 14:37

NVD link : CVE-2024-58063

Mitre link : CVE-2024-58063

CVE.ORG link : CVE-2024-58063

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime