CVE-2024-35811: wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
In the Linux kernel, the following vulnerability has been resolved:
wifi: brcmfmac: Fix use-after-free bug in brcmfcfg80211detach
This is the candidate patch of CVE-2023-47233 : https://nvd.nist.gov/vuln/detail/CVE-2023-47233
In brcm80211 driver,it starts with the following invoking chain to start init a timeout worker:
->brcmfusbprobe ->brcmfusbprobecb ->brcmfattach ->brcmfbusstarted ->brcmfcfg80211attach ->wlinitpriv ->brcmfinitescan ->INITWORK(&cfg->escantimeoutwork, brcmfcfg80211escantimeoutworker);
If we disconnect the USB by hotplug, it will call brcmfusbdisconnect to make cleanup. The invoking chain is :
brcmfusbdisconnect ->brcmfusbdisconnectcb ->brcmfdetach ->brcmfcfg80211detach ->kfree(cfg);
While the timeout woker may still be running. This will cause a use-after-free bug on cfg in brcmfcfg80211escantimeoutworker.
Fix it by deleting the timer and canceling the worker in brcmfcfg80211detach.
[arend.vanspriel@broadcom.com: keep timer delete as is and cancel work just before free]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
linux kernel (wifi: brcmfmac)to a version that resolves this vulnerability.Patch CVE-2023-47233 - Configuration
In brcmf_cfg80211_detach, keep timer deletion as-is, and cancel the escan timeout worker immediately before calling kfree(cfg), so brcmf_cfg80211_escan_timeout_worker cannot run on freed cfg during USB hotplug cleanup (use-after-free described in CVE-2023-47233).
brcmfmac driver cfg->escan_timeout_work lifecycle management in brcmf_cfg80211_detach = delete timer and cancel worker before kfree(cfg)
Event History
Frequently Asked Questions
What is the severity of CVE-2024-35811?
CVE-2024-35811 has been classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2024-35811?
To fix CVE-2024-35811, upgrade the Linux kernel to the latest patched version provided by your distribution.
What systems are affected by CVE-2024-35811?
CVE-2024-35811 affects multiple versions of the Linux kernel, specifically versions between 3.7 and 6.8.3.
What type of vulnerability is CVE-2024-35811?
CVE-2024-35811 is classified as a use-after-free vulnerability in the brcmfmac driver of the Linux kernel.
Are there any known exploits for CVE-2024-35811?
As of now, there are no publicly known exploits for CVE-2024-35811.