CVE-2024-35879

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-35879

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: of: dynamic: Synchronize of_changeset_destroy() with the devlink removals In the following sequence: 1) of_platform_depopulate() 2) of_overlay_remove() During the step 1, devices are destroyed and devlinks are removed. During the step 2, OF nodes are destroyed but __of_changeset_entry_destroy() can raise warnings related to missing of_node_put(): ERROR: memory leak, expected refcount 1 instead of 2 ... Indeed, during the devlink removals performed at step 1, the removal itself releasing the device (and the attached of_node) is done by a job queued in a workqueue and so, it is done asynchronously with respect to function calls. When the warning is present, of_node_put() will be called but wrongly too late from the workqueue job. In order to be sure that any ongoing devlink removals are done before the of_node destruction, synchronize the of_changeset_destroy() with the devlink removals.

References
Link Resource
https://git.kernel.org/stable/c/3127b2ee50c424a96eb3559fbb7b43cf0b111c7a Patch
https://git.kernel.org/stable/c/3ee2424107546d882e1ddd75333ca9c32879908c Patch
https://git.kernel.org/stable/c/7b6df050c45a1ea158fd50bc32a8e1447dd1e951 Patch
https://git.kernel.org/stable/c/801c8b8ec5bfb3519566dff16a5ecd48302fca82 Patch
https://git.kernel.org/stable/c/8917e7385346bd6584890ed362985c219fe6ae84 Patch
https://git.kernel.org/stable/c/ae6d76e4f06c37a623e357e79d49b17411db6f5c Patch
https://git.kernel.org/stable/c/3127b2ee50c424a96eb3559fbb7b43cf0b111c7a Patch
https://git.kernel.org/stable/c/3ee2424107546d882e1ddd75333ca9c32879908c Patch
https://git.kernel.org/stable/c/7b6df050c45a1ea158fd50bc32a8e1447dd1e951 Patch
https://git.kernel.org/stable/c/801c8b8ec5bfb3519566dff16a5ecd48302fca82 Patch
https://git.kernel.org/stable/c/8917e7385346bd6584890ed362985c219fe6ae84 Patch
https://git.kernel.org/stable/c/ae6d76e4f06c37a623e357e79d49b17411db6f5c Patch
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
History

23 Dec 2025, 19:29

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/3127b2ee50c424a96eb3559fbb7b43cf0b111c7a - () https://git.kernel.org/stable/c/3127b2ee50c424a96eb3559fbb7b43cf0b111c7a - Patch
References () https://git.kernel.org/stable/c/3ee2424107546d882e1ddd75333ca9c32879908c - () https://git.kernel.org/stable/c/3ee2424107546d882e1ddd75333ca9c32879908c - Patch
References () https://git.kernel.org/stable/c/7b6df050c45a1ea158fd50bc32a8e1447dd1e951 - () https://git.kernel.org/stable/c/7b6df050c45a1ea158fd50bc32a8e1447dd1e951 - Patch
References () https://git.kernel.org/stable/c/801c8b8ec5bfb3519566dff16a5ecd48302fca82 - () https://git.kernel.org/stable/c/801c8b8ec5bfb3519566dff16a5ecd48302fca82 - Patch
References () https://git.kernel.org/stable/c/8917e7385346bd6584890ed362985c219fe6ae84 - () https://git.kernel.org/stable/c/8917e7385346bd6584890ed362985c219fe6ae84 - Patch
References () https://git.kernel.org/stable/c/ae6d76e4f06c37a623e357e79d49b17411db6f5c - () https://git.kernel.org/stable/c/ae6d76e4f06c37a623e357e79d49b17411db6f5c - Patch
References () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html - () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html - Third Party Advisory
CPE cpe:2.3:o:linux:linux_kernel:5.13:rc4:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.13:rc6:*:*:*:*:*:*
CWE CWE-401
First Time Linux
Debian debian Linux
Linux linux Kernel
Debian
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

21 Nov 2024, 09:21

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html -
References () https://git.kernel.org/stable/c/3127b2ee50c424a96eb3559fbb7b43cf0b111c7a - () https://git.kernel.org/stable/c/3127b2ee50c424a96eb3559fbb7b43cf0b111c7a -
References () https://git.kernel.org/stable/c/3ee2424107546d882e1ddd75333ca9c32879908c - () https://git.kernel.org/stable/c/3ee2424107546d882e1ddd75333ca9c32879908c -
References () https://git.kernel.org/stable/c/7b6df050c45a1ea158fd50bc32a8e1447dd1e951 - () https://git.kernel.org/stable/c/7b6df050c45a1ea158fd50bc32a8e1447dd1e951 -
References () https://git.kernel.org/stable/c/801c8b8ec5bfb3519566dff16a5ecd48302fca82 - () https://git.kernel.org/stable/c/801c8b8ec5bfb3519566dff16a5ecd48302fca82 -
References () https://git.kernel.org/stable/c/8917e7385346bd6584890ed362985c219fe6ae84 - () https://git.kernel.org/stable/c/8917e7385346bd6584890ed362985c219fe6ae84 -
References () https://git.kernel.org/stable/c/ae6d76e4f06c37a623e357e79d49b17411db6f5c - () https://git.kernel.org/stable/c/ae6d76e4f06c37a623e357e79d49b17411db6f5c -

05 Nov 2024, 10:16

Type Values Removed Values Added
References
  • {'url': 'https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}

25 Jun 2024, 22:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html -
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: of:dynamic: Sincronizar of_changeset_destroy() con las eliminaciones de devlink En la siguiente secuencia: 1) of_platform_depopulate() 2) of_overlay_remove() Durante el paso 1, los dispositivos se destruyen y los devlinks son remoto. Durante el paso 2, los nodos OF se destruyen, pero __of_changeset_entry_destroy() puede generar advertencias relacionadas con la falta de of_node_put(): ERROR: pérdida de memoria, recuento esperado 1 en lugar de 2... De hecho, durante las eliminaciones de devlink realizadas en el paso 1, la eliminación La liberación del dispositivo (y el of_node adjunto) se realiza mediante un trabajo en cola en una cola de trabajo y, por lo tanto, se realiza de forma asincrónica con respecto a las llamadas a funciones. Cuando la advertencia está presente, se llamará a of_node_put() pero erróneamente demasiado tarde desde el trabajo de la cola de trabajo. Para asegurarse de que cualquier eliminación de devlink en curso se realice antes de la destrucción de of_node, sincronice of_changeset_destroy() con las eliminaciones de devlink.

19 May 2024, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-19 09:15

Updated : 2025-12-23 19:29

NVD link : CVE-2024-35879

Mitre link : CVE-2024-35879

CVE.ORG link : CVE-2024-35879

JSON object : View

Products Affected

linux

debian

CWE
CWE-401

Missing Release of Memory after Effective Lifetime