CVE-2024-38628 - Vulnerability Details - OpenCVE

ReportizFlow

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind. Hang on to the control IDs instead of pointers since those are correctly handled with locks.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/1b739388aa3f8dfb63a9fca777e6dfa6912d0464
https://git.kernel.org/stable/c/453d3fa9266e53f85377b911c19b9a4563fa88c0
https://git.kernel.org/stable/c/89e66809684485590ea0b32c3178e42cba36ac09
https://git.kernel.org/stable/c/bea73b58ab67fe581037ad9cdb93c2557590c068
https://lore.kernel.org/linux-cve-announce/2024062140-CVE-2024-38628-e2db@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2024-38628
https://www.cve.org/CVERecord?id=CVE-2024-38628

History

Tue, 05 Nov 2024 17:15:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-06-21T10:18:19.558Z

Updated: 2024-12-19T09:05:58.378Z

Reserved: 2024-06-18T19:36:34.946Z

Link: CVE-2024-38628

Vulnrichment

Updated: 2024-08-02T04:12:26.065Z

NVD

Status : Awaiting Analysis

Published: 2024-06-21T11:15:11.660

Modified: 2024-11-21T09:26:31.563

Link: CVE-2024-38628

Redhat

Severity : Low

Publid Date: 2024-06-21T00:00:00Z

Links: CVE-2024-38628 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-38628", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-06-18T19:36:34.946Z", "datePublished": "2024-06-21T10:18:19.558Z", "dateUpdated": "2024-12-19T09:05:58.378Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-12-19T09:05:58.378Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind.\n\nHang on to the control IDs instead of pointers since those are correctly\nhandled with locks."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/gadget/function/u_audio.c"], "versions": [{"version": "02de698ca8123782c0c6fb8ed99080e2f032b0d2", "lessThan": "89e66809684485590ea0b32c3178e42cba36ac09", "status": "affected", "versionType": "git"}, {"version": "02de698ca8123782c0c6fb8ed99080e2f032b0d2", "lessThan": "453d3fa9266e53f85377b911c19b9a4563fa88c0", "status": "affected", "versionType": "git"}, {"version": "02de698ca8123782c0c6fb8ed99080e2f032b0d2", "lessThan": "bea73b58ab67fe581037ad9cdb93c2557590c068", "status": "affected", "versionType": "git"}, {"version": "02de698ca8123782c0c6fb8ed99080e2f032b0d2", "lessThan": "1b739388aa3f8dfb63a9fca777e6dfa6912d0464", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/gadget/function/u_audio.c"], "versions": [{"version": "5.15", "status": "affected"}, {"version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.93", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.33", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9.4", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/89e66809684485590ea0b32c3178e42cba36ac09"}, {"url": "https://git.kernel.org/stable/c/453d3fa9266e53f85377b911c19b9a4563fa88c0"}, {"url": "https://git.kernel.org/stable/c/bea73b58ab67fe581037ad9cdb93c2557590c068"}, {"url": "https://git.kernel.org/stable/c/1b739388aa3f8dfb63a9fca777e6dfa6912d0464"}], "title": "usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind.", "x_generator": {"engine": "bippy-5f407fcff5a0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-362", "lang": "en", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-06-24T15:20:09.528911Z", "id": "CVE-2024-38628", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-05T16:32:35.156Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:12:26.065Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/89e66809684485590ea0b32c3178e42cba36ac09", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/453d3fa9266e53f85377b911c19b9a4563fa88c0", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/bea73b58ab67fe581037ad9cdb93c2557590c068", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1b739388aa3f8dfb63a9fca777e6dfa6912d0464", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/89e66809684485590ea0b32c3178e42cba36ac09", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/453d3fa9266e53f85377b911c19b9a4563fa88c0", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/bea73b58ab67fe581037ad9cdb93c2557590c068", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1b739388aa3f8dfb63a9fca777e6dfa6912d0464", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:12:26.065Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-38628", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-24T15:20:09.528911Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-24T15:20:28.195Z"}}], "cna": {"title": "usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind.", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "02de698ca8123782c0c6fb8ed99080e2f032b0d2", "lessThan": "89e66809684485590ea0b32c3178e42cba36ac09", "versionType": "git"}, {"status": "affected", "version": "02de698ca8123782c0c6fb8ed99080e2f032b0d2", "lessThan": "453d3fa9266e53f85377b911c19b9a4563fa88c0", "versionType": "git"}, {"status": "affected", "version": "02de698ca8123782c0c6fb8ed99080e2f032b0d2", "lessThan": "bea73b58ab67fe581037ad9cdb93c2557590c068", "versionType": "git"}, {"status": "affected", "version": "02de698ca8123782c0c6fb8ed99080e2f032b0d2", "lessThan": "1b739388aa3f8dfb63a9fca777e6dfa6912d0464", "versionType": "git"}], "programFiles": ["drivers/usb/gadget/function/u_audio.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.15"}, {"status": "unaffected", "version": "0", "lessThan": "5.15", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.93", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.33", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.9.4", "versionType": "semver", "lessThanOrEqual": "6.9.*"}, {"status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/usb/gadget/function/u_audio.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/89e66809684485590ea0b32c3178e42cba36ac09"}, {"url": "https://git.kernel.org/stable/c/453d3fa9266e53f85377b911c19b9a4563fa88c0"}, {"url": "https://git.kernel.org/stable/c/bea73b58ab67fe581037ad9cdb93c2557590c068"}, {"url": "https://git.kernel.org/stable/c/1b739388aa3f8dfb63a9fca777e6dfa6912d0464"}], "x_generator": {"engine": "bippy-5f407fcff5a0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind.\n\nHang on to the control IDs instead of pointers since those are correctly\nhandled with locks."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-12-19T09:05:58.378Z"}}}, "cveMetadata": {"cveId": "CVE-2024-38628", "state": "PUBLISHED", "dateUpdated": "2024-12-19T09:05:58.378Z", "dateReserved": "2024-06-18T19:36:34.946Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-06-21T10:18:19.558Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind.\n\nHang on to the control IDs instead of pointers since those are correctly\nhandled with locks."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: usb: gadget: u_audio: se corrigi\u00f3 el uso de los controles en condiciones de ejecuci\u00f3n despu\u00e9s de liberarse durante la desvinculaci\u00f3n del gadget. Conserve las ID de control en lugar de los punteros, ya que se manejan correctamente con candados."}], "id": "CVE-2024-38628", "lastModified": "2024-11-21T09:26:31.563", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-06-21T11:15:11.660", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1b739388aa3f8dfb63a9fca777e6dfa6912d0464"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/453d3fa9266e53f85377b911c19b9a4563fa88c0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/89e66809684485590ea0b32c3178e42cba36ac09"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bea73b58ab67fe581037ad9cdb93c2557590c068"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://git.kernel.org/stable/c/1b739388aa3f8dfb63a9fca777e6dfa6912d0464"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://git.kernel.org/stable/c/453d3fa9266e53f85377b911c19b9a4563fa88c0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://git.kernel.org/stable/c/89e66809684485590ea0b32c3178e42cba36ac09"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://git.kernel.org/stable/c/bea73b58ab67fe581037ad9cdb93c2557590c068"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}