CVE-2024-53213: net: usb: lan78xx: Fix double free issue with interrupt buffer allocation
In the Linux kernel, the following vulnerability has been resolved:
net: usb: lan78xx: Fix double free issue with interrupt buffer allocation
In lan78xxprobe(), the buffer buf was being freed twice: once implicitly through usbfreeurb(dev->urbintr) with the URBFREEBUFFER flag and again explicitly by kfree(buf). This caused a double free issue.
To resolve this, reordered kmalloc() and usballocurb() calls to simplify the initialization sequence and removed the redundant kfree(buf). Now, buf is allocated after usballocurb(), ensuring it is correctly managed by usbfillinturb() and freed by usbfreeurb() as intended.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
net: usb: lan78xx: Fix double free issue with interrupt buffer allocation
In lan78xxprobe(), the buffer buf was being freed twice: once implicitly through usbfreeurb(dev->urbintr) with the URBFREEBUFFER flag and again explicitly by kfree(buf). This caused a double free issue.
To resolve this, reordered kmalloc() and usballocurb() calls to simplify the initialization sequence and removed the redundant kfree(buf). Now, buf is allocated after usballocurb(), ensuring it is correctly managed by usbfillinturb() and freed by usbfreeurb() as intended.
— NVD
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-53213?
CVE-2024-53213 is classified with a medium severity level due to its potential impact on system stability.
How do I fix CVE-2024-53213?
To fix CVE-2024-53213, upgrade the Linux kernel to versions 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.128-1, 6.12.12-1, or 6.12.15-1.
Which versions of the Linux kernel are affected by CVE-2024-53213?
CVE-2024-53213 affects Linux kernel versions from 5.17 to 6.1.120, 6.2 to 6.6.64, 6.7 to 6.11.11, and 6.12 to 6.12.2.
Is CVE-2024-53213 an exploit-related vulnerability?
CVE-2024-53213 is a resource management issue rather than an exploit-based vulnerability.
What type of issue is described by CVE-2024-53213?
CVE-2024-53213 describes a double free issue in the USB lan78xx driver leading to potential memory corruption.