CVE-2024-27043

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: media: edia: dvbdev: fix a use-after-free In dvb_register_device, *pdvbdev is set equal to dvbdev, which is freed in several error-handling paths. However, *pdvbdev is not set to NULL after dvbdev's deallocation, causing use-after-frees in many places, for example, in the following call chain: budget_register |-> dvb_dmxdev_init |-> dvb_register_device |-> dvb_dmxdev_release |-> dvb_unregister_device |-> dvb_remove_device |-> dvb_device_put |-> kref_put When calling dvb_unregister_device, dmxdev->dvbdev (i.e. *pdvbdev in dv...

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= b61901024776b25ce7b8edc31bb1757c7382a88e < d0f5c28333822f9baa5280d813124920720fd856, >= b61901024776b25ce7b8edc31bb1757c7382a88e < f20c3270f3ed5aa6919a87e4de9bf6c05fb57086, >= b61901024776b25ce7b8edc31bb1757c7382a88e < 096237039d00c839f3e3a5fe6d001bf0db45b644, >= b61901024776b25ce7b8edc31bb1757c7382a88e < 0d3fe80b6d175c220b3e252efc6c6777e700e98e, >= b61901024776b25ce7b8edc31bb1757c7382a88e < 437a111f79a2f5b2a5f21e27fdec6f40c8768712, >= b61901024776b25ce7b8edc31bb1757c7382a88e < 779e8db7efb22316c8581d6c229636d2f5694a62, >= b61901024776b25ce7b8edc31bb1757c7382a88e < 35674111a043b0482a9bc69da8850a83f465b07d, >= b61901024776b25ce7b8edc31bb1757c7382a88e < b7586e902128e4fb7bfbb661cb52e4215a65637b, >= b61901024776b25ce7b8edc31bb1757c7382a88e < 8c64f4cdf4e6cc5682c52523713af8c39c94e6d5, >= 2.6.21, >= 2.6.21 < 4.19.311, >= 4.20 < 5.4.273, >= 5.5 < 5.10.214, >= 5.11 < 5.15.153, >= 5.16 < 6.1.83, >= 6.2 < 6.6.23, >= 6.7 < 6.7.11, >= 6.8 < 6.8.2

Fixed versions

4.19.311, 5.4.273, 5.10.214, 5.15.153, 6.1.83, 6.6.23, 6.7.11, 6.8.2

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416