CVE-2024-43883
usb: vhci-hcd: Do not drop references before new references are gained
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.6.33, 2.6.34, 2.6.35, 2.6.36, 2.6.38
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
CISA's decision points: whether it is exploited, whether attacks can be automated, and how much control an attacker gets. Assessed (SSVC 2.0.3).What do these mean? →
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: vhci-hcd: Do not drop references before new references are gained At a few places the driver carries stale pointers to references that can still be used. Make sure that does not happen. This strictly speaking closes ZDI-CAN-22273, though there may be similar races in the driver.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- Linux Linux
From 2.6.32.30 · fixed in 2.6.33; From 2.6.33.8 · fixed in 2.6.34; From 2.6.34.10 · fixed in 2.6.35; From 2.6.35.12 · fixed in 2.6.36; From 2.6.37.3 · fixed in 2.6.38
- Linux Linux
2.6.38
References 8
git.kernel.org
- stable/c/5a3c473b28ae1c1f7c4dc129e30cb19ae6e96f89
- stable/c/9c3746ce8d8fcb3a2405644fc0eec7fc5312de80
- stable/c/4dacdb9720aaab10b6be121eae55820174d97174
- stable/c/e8c1e606dab8c56cf074b43b98d0805de7322ba2
- stable/c/585e6bc7d0a9bf73a8be3d3fb34e86b90cc61a14
- stable/c/128e82e41cf7d74a562726c1587d9d2ede1a0a37
- stable/c/c3d0857b7fc2c49f68f89128a5440176089a8f54
- stable/c/afdcfd3d6fcdeca2735ca8d994c5f2d24a368f0a