CVE-2024-43883: usb: vhci-hcd: Do not drop references before new references are gained
In the Linux kernel, the following vulnerability has been resolved:
usb: vhci-hcd: Do not drop references before new references are gained
At a few places the driver carries stale pointers to references that can still be used. Make sure that does not happen. This strictly speaking closes ZDI-CAN-22273, though there may be similar races in the driver.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Upgrade
Upgrade
Linux kernel usb: vhci-hcdto a version that resolves this vulnerability.Patch ZDI-CAN-22273 - Compensating control
Apply the resolved fix for “usb: vhci-hcd: Do not drop references before new references are gained” to ensure the driver does not drop references before acquiring new ones, preventing stale pointers/references-from-races (covers ZDI-CAN-22273).
Event History
Frequently Asked Questions
What is the severity of CVE-2024-43883?
CVE-2024-43883 has been classified as a high severity vulnerability due to potential misuse of stale pointers in the Linux kernel.
How do I fix CVE-2024-43883?
To fix CVE-2024-43883, update your Linux kernel to versions 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.11-1, or 6.12.12-1.
Which systems are affected by CVE-2024-43883?
CVE-2024-43883 affects various Debian Linux kernel versions up to 5.10.223-1.
What is the impact of CVE-2024-43883 on my system?
The impact of CVE-2024-43883 could allow attackers to exploit stale pointer references, potentially leading to system instability or unauthorized access.
Is there a known exploit for CVE-2024-43883?
As of now, there are no publicly known exploits specifically targeting CVE-2024-43883.