CVE-2024-26653 - Vulnerability Details - OpenCVE

ReportizFlow

In the Linux kernel, the following vulnerability has been resolved: usb: misc: ljca: Fix double free in error handling path When auxiliary_device_add() returns error and then calls auxiliary_device_uninit(), callback function ljca_auxdev_release calls kfree(auxdev->dev.platform_data) to free the parameter data of the function ljca_new_client_device. The callers of ljca_new_client_device shouldn't call kfree() again in the error handling path to free the platform data. Fix this by cleaning up the redundant kfree() in all callers and adding kfree() the passed in platform_data on errors which happen before auxiliary_device_init() succeeds .

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/420babea4f1881a7c4ea22a8e218b8c6895d3f21
https://git.kernel.org/stable/c/7c9631969287a5366bc8e39cd5abff154b35fb80
https://git.kernel.org/stable/c/8a9f653cc852677003c23ee8075e3ed8fb4743c9
https://lore.kernel.org/linux-cve-announce/2024040122-CVE-2024-26653-7903@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2024-26653
https://www.cve.org/CVERecord?id=CVE-2024-26653

History

Tue, 05 Nov 2024 10:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-04-01T08:33:04.200Z

Updated: 2024-12-19T08:44:22.044Z

Reserved: 2024-02-19T14:20:24.144Z

Link: CVE-2024-26653

Vulnrichment

Updated: 2024-08-02T00:07:19.799Z

NVD

Status : Awaiting Analysis

Published: 2024-04-01T09:15:51.010

Modified: 2024-11-21T09:02:46.333

Link: CVE-2024-26653

Redhat

Severity : Moderate

Publid Date: 2024-04-01T00:00:00Z

Links: CVE-2024-26653 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-26653", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.144Z", "datePublished": "2024-04-01T08:33:04.200Z", "dateUpdated": "2024-12-19T08:44:22.044Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-12-19T08:44:22.044Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: misc: ljca: Fix double free in error handling path\n\nWhen auxiliary_device_add() returns error and then calls\nauxiliary_device_uninit(), callback function ljca_auxdev_release\ncalls kfree(auxdev->dev.platform_data) to free the parameter data\nof the function ljca_new_client_device. The callers of\nljca_new_client_device shouldn't call kfree() again\nin the error handling path to free the platform data.\n\nFix this by cleaning up the redundant kfree() in all callers and\nadding kfree() the passed in platform_data on errors which happen\nbefore auxiliary_device_init() succeeds ."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/misc/usb-ljca.c"], "versions": [{"version": "acd6199f195d6de814ac4090ce0864a613b1580e", "lessThan": "420babea4f1881a7c4ea22a8e218b8c6895d3f21", "status": "affected", "versionType": "git"}, {"version": "acd6199f195d6de814ac4090ce0864a613b1580e", "lessThan": "8a9f653cc852677003c23ee8075e3ed8fb4743c9", "status": "affected", "versionType": "git"}, {"version": "acd6199f195d6de814ac4090ce0864a613b1580e", "lessThan": "7c9631969287a5366bc8e39cd5abff154b35fb80", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/misc/usb-ljca.c"], "versions": [{"version": "6.7", "status": "affected"}, {"version": "0", "lessThan": "6.7", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.12", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.3", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/420babea4f1881a7c4ea22a8e218b8c6895d3f21"}, {"url": "https://git.kernel.org/stable/c/8a9f653cc852677003c23ee8075e3ed8fb4743c9"}, {"url": "https://git.kernel.org/stable/c/7c9631969287a5366bc8e39cd5abff154b35fb80"}], "title": "usb: misc: ljca: Fix double free in error handling path", "x_generator": {"engine": "bippy-5f407fcff5a0"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:07:19.799Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/420babea4f1881a7c4ea22a8e218b8c6895d3f21", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8a9f653cc852677003c23ee8075e3ed8fb4743c9", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/7c9631969287a5366bc8e39cd5abff154b35fb80", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-15T19:26:24.626157Z", "id": "CVE-2024-26653", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-15T19:26:32.668Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/420babea4f1881a7c4ea22a8e218b8c6895d3f21", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8a9f653cc852677003c23ee8075e3ed8fb4743c9", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/7c9631969287a5366bc8e39cd5abff154b35fb80", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:07:19.799Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26653", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-15T19:26:24.626157Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-15T19:26:29.783Z"}}], "cna": {"title": "usb: misc: ljca: Fix double free in error handling path", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "acd6199f195d6de814ac4090ce0864a613b1580e", "lessThan": "420babea4f1881a7c4ea22a8e218b8c6895d3f21", "versionType": "git"}, {"status": "affected", "version": "acd6199f195d6de814ac4090ce0864a613b1580e", "lessThan": "8a9f653cc852677003c23ee8075e3ed8fb4743c9", "versionType": "git"}, {"status": "affected", "version": "acd6199f195d6de814ac4090ce0864a613b1580e", "lessThan": "7c9631969287a5366bc8e39cd5abff154b35fb80", "versionType": "git"}], "programFiles": ["drivers/usb/misc/usb-ljca.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.7"}, {"status": "unaffected", "version": "0", "lessThan": "6.7", "versionType": "semver"}, {"status": "unaffected", "version": "6.7.12", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8.3", "versionType": "semver", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/usb/misc/usb-ljca.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/420babea4f1881a7c4ea22a8e218b8c6895d3f21"}, {"url": "https://git.kernel.org/stable/c/8a9f653cc852677003c23ee8075e3ed8fb4743c9"}, {"url": "https://git.kernel.org/stable/c/7c9631969287a5366bc8e39cd5abff154b35fb80"}], "x_generator": {"engine": "bippy-5f407fcff5a0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: misc: ljca: Fix double free in error handling path\n\nWhen auxiliary_device_add() returns error and then calls\nauxiliary_device_uninit(), callback function ljca_auxdev_release\ncalls kfree(auxdev->dev.platform_data) to free the parameter data\nof the function ljca_new_client_device. The callers of\nljca_new_client_device shouldn't call kfree() again\nin the error handling path to free the platform data.\n\nFix this by cleaning up the redundant kfree() in all callers and\nadding kfree() the passed in platform_data on errors which happen\nbefore auxiliary_device_init() succeeds ."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-12-19T08:44:22.044Z"}}}, "cveMetadata": {"cveId": "CVE-2024-26653", "state": "PUBLISHED", "dateUpdated": "2024-12-19T08:44:22.044Z", "dateReserved": "2024-02-19T14:20:24.144Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-04-01T08:33:04.200Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: misc: ljca: Fix double free in error handling path\n\nWhen auxiliary_device_add() returns error and then calls\nauxiliary_device_uninit(), callback function ljca_auxdev_release\ncalls kfree(auxdev->dev.platform_data) to free the parameter data\nof the function ljca_new_client_device. The callers of\nljca_new_client_device shouldn't call kfree() again\nin the error handling path to free the platform data.\n\nFix this by cleaning up the redundant kfree() in all callers and\nadding kfree() the passed in platform_data on errors which happen\nbefore auxiliary_device_init() succeeds ."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: usb: misc: ljca: corrige el doble libre en la ruta de manejo de errores Cuando auxiliar_device_add() devuelve un error y luego llama a auxiliar_device_uninit(), la funci\u00f3n de devoluci\u00f3n de llamada ljca_auxdev_release llama a kfree(auxdev->dev.platform_data ) para liberar los datos de los par\u00e1metros de la funci\u00f3n ljca_new_client_device. Las personas que llaman a ljca_new_client_device no deber\u00edan volver a llamar a kfree() en la ruta de manejo de errores para liberar los datos de la plataforma. Solucione este problema limpiando el kfree() redundante en todas las personas que llaman y agregando kfree() los datos de plataforma pasados en los errores que ocurren antes de queauxiliar_device_init() tenga \u00e9xito."}], "id": "CVE-2024-26653", "lastModified": "2024-11-21T09:02:46.333", "metrics": {}, "published": "2024-04-01T09:15:51.010", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/420babea4f1881a7c4ea22a8e218b8c6895d3f21"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7c9631969287a5366bc8e39cd5abff154b35fb80"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8a9f653cc852677003c23ee8075e3ed8fb4743c9"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://git.kernel.org/stable/c/420babea4f1881a7c4ea22a8e218b8c6895d3f21"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://git.kernel.org/stable/c/7c9631969287a5366bc8e39cd5abff154b35fb80"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://git.kernel.org/stable/c/8a9f653cc852677003c23ee8075e3ed8fb4743c9"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Awaiting Analysis"}

{"bugzilla": {"description": "kernel: usb: misc: ljca: Fix double free in error handling path", "id": "2272444", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2272444"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-415", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nusb: misc: ljca: Fix double free in error handling path\nWhen auxiliary_device_add() returns error and then calls\nauxiliary_device_uninit(), callback function ljca_auxdev_release\ncalls kfree(auxdev->dev.platform_data) to free the parameter data\nof the function ljca_new_client_device. The callers of\nljca_new_client_device shouldn't call kfree() again\nin the error handling path to free the platform data.\nFix this by cleaning up the redundant kfree() in all callers and\nadding kfree() the passed in platform_data on errors which happen\nbefore auxiliary_device_init() succeeds .", "A vulnerability was found in the USB misc/ljca driver for Linux kernel resulted in a double free occurred during error handling when an auxiliary_device_add() encountered an error and invoked auxiliary_device_uninit(), the function ljca_auxdev_release erroneously called kfree() on auxdev->dev.platform_data, leading to double freeing of the parameter data."], "mitigation": {"lang": "en:us", "value": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible."}, "name": "CVE-2024-26653", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-04-01T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-26653\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-26653\nhttps://lore.kernel.org/linux-cve-announce/2024040122-CVE-2024-26653-7903@gregkh/T"], "threat_severity": "Moderate", "upstream_fix": "kernel 6.9-rc2"}