CVE-2024-35811
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2024
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach This is the candidate patch of CVE-2023-47233 : https://nvd.nist.gov/vuln/detail/CVE-2023-47233 In brcm80211 driver,it starts with the following invoking chain to start init a timeout worker: ->brcmf_usb_probe ->brcmf_usb_probe_cb ->brcmf_attach ->brcmf_bus_started ->brcmf_cfg80211_attach ->wl_init_priv ->brcmf_init_escan ->INIT_WORK(&cfg->escan_timeout_work, brcmf_cfg80211_escan_timeout_worker); If we disconnect the USB by hotplug, it will call brcmf_usb_disconnect to make cleanup. The invoking chain is : brcmf_usb_disconnect ->brcmf_usb_disconnect_cb ->brcmf_detach ->brcmf_cfg80211_detach ->kfree(cfg); While the timeout woker may still be running. This will cause a use-after-free bug on cfg in brcmf_cfg80211_escan_timeout_worker. Fix it by deleting the timer and canceling the worker in brcmf_cfg80211_detach. [arend.vanspriel@broadcom.com: keep timer delete as is and cancel work just before free]
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| e756af5b30b008f6ffcfebf8ad0b477f6f225b62 | affected | git | 202c503935042272e2f9e1bb549d5f69a8681169 | Unavailable | None listed |
| e756af5b30b008f6ffcfebf8ad0b477f6f225b62 | affected | git | 8e3f03f4ef7c36091f46e7349096efb5a2cdb3a1 | Unavailable | None listed |
| e756af5b30b008f6ffcfebf8ad0b477f6f225b62 | affected | git | bacb8c3ab86dcd760c15903fcee58169bc3026aa | Unavailable | None listed |
| e756af5b30b008f6ffcfebf8ad0b477f6f225b62 | affected | git | 8c36205123dc57349b59b4f1a2301eb278cbc731 | Unavailable | None listed |
| e756af5b30b008f6ffcfebf8ad0b477f6f225b62 | affected | git | 0b812f706fd7090be74812101114a0e165b36744 | Unavailable | None listed |
| e756af5b30b008f6ffcfebf8ad0b477f6f225b62 | affected | git | 190794848e2b9d15de92d502b6ac652806904f5a | Unavailable | None listed |
| e756af5b30b008f6ffcfebf8ad0b477f6f225b62 | affected | git | 6678a1e7d896c00030b31491690e8ddc9a90767a | Unavailable | None listed |
| e756af5b30b008f6ffcfebf8ad0b477f6f225b62 | affected | git | 0a7591e14a8da794d0b93b5d1c6254ccb23adacb | Unavailable | None listed |
| e756af5b30b008f6ffcfebf8ad0b477f6f225b62 | affected | git | 0f7352557a35ab7888bc7831411ec8a3cbe20d78 | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 3.7 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 3.7 | Unavailable | None listed |
| 4.19.312 | unaffected | semver | Unavailable | 4.19.* | None listed |
| 5.4.274 | unaffected | semver | Unavailable | 5.4.* | None listed |
| 5.10.215 | unaffected | semver | Unavailable | 5.10.* | None listed |
| 5.15.154 | unaffected | semver | Unavailable | 5.15.* | None listed |
| 6.1.84 | unaffected | semver | Unavailable | 6.1.* | None listed |
| 6.6.24 | unaffected | semver | Unavailable | 6.6.* | None listed |
| 6.7.12 | unaffected | semver | Unavailable | 6.7.* | None listed |
| 6.8.3 | unaffected | semver | Unavailable | 6.8.* | None listed |
| 6.9 | unaffected | original_commit_for_fix | Unavailable | * | None listed |