CVE-2024-38611

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-38611

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: media: i2c: et8ek8: Don't strip remove function when driver is builtin Using __exit for the remove function results in the remove callback being discarded with CONFIG_VIDEO_ET8EK8=y. When such a device gets unbound (e.g. using sysfs or hotplug), the driver is just removed without the cleanup being performed. This results in resource leaks. Fix it by compiling in the remove callback unconditionally. This also fixes a W=1 modpost warning: WARNING: modpost: drivers/media/i2c/et8ek8/et8ek8: section mismatch in reference: et8ek8_i2c_driver+0x10 (section: .data) -> et8ek8_remove (section: .exit.text)

References
Link Resource
https://git.kernel.org/stable/c/04d1086a62ac492ebb6bb0c94c1c8cb55f5d1f36 Patch
https://git.kernel.org/stable/c/43fff07e4b1956d0e5cf23717507e438278ea3d9 Patch
https://git.kernel.org/stable/c/545b215736c5c4b354e182d99c578a472ac9bfce Patch
https://git.kernel.org/stable/c/904db2ba44ae60641b6378c5013254d09acf5e80 Patch
https://git.kernel.org/stable/c/963523600d9f1e36bc35ba774c2493d6baa4dd8f Patch
https://git.kernel.org/stable/c/c1a3803e5bb91c13e9ad582003e4288f67f06cd9 Patch
https://git.kernel.org/stable/c/ece3fc1c10197052044048bea4f13cfdcf25b416 Patch
https://git.kernel.org/stable/c/43fff07e4b1956d0e5cf23717507e438278ea3d9 Patch
https://git.kernel.org/stable/c/545b215736c5c4b354e182d99c578a472ac9bfce Patch
https://git.kernel.org/stable/c/904db2ba44ae60641b6378c5013254d09acf5e80 Patch
https://git.kernel.org/stable/c/c1a3803e5bb91c13e9ad582003e4288f67f06cd9 Patch
https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html
https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

03 Nov 2025, 20:16

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html -
  • () https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html -

03 Oct 2025, 15:24

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux
Linux linux Kernel
CWE CWE-401
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/04d1086a62ac492ebb6bb0c94c1c8cb55f5d1f36 - () https://git.kernel.org/stable/c/04d1086a62ac492ebb6bb0c94c1c8cb55f5d1f36 - Patch
References () https://git.kernel.org/stable/c/43fff07e4b1956d0e5cf23717507e438278ea3d9 - () https://git.kernel.org/stable/c/43fff07e4b1956d0e5cf23717507e438278ea3d9 - Patch
References () https://git.kernel.org/stable/c/545b215736c5c4b354e182d99c578a472ac9bfce - () https://git.kernel.org/stable/c/545b215736c5c4b354e182d99c578a472ac9bfce - Patch
References () https://git.kernel.org/stable/c/904db2ba44ae60641b6378c5013254d09acf5e80 - () https://git.kernel.org/stable/c/904db2ba44ae60641b6378c5013254d09acf5e80 - Patch
References () https://git.kernel.org/stable/c/963523600d9f1e36bc35ba774c2493d6baa4dd8f - () https://git.kernel.org/stable/c/963523600d9f1e36bc35ba774c2493d6baa4dd8f - Patch
References () https://git.kernel.org/stable/c/c1a3803e5bb91c13e9ad582003e4288f67f06cd9 - () https://git.kernel.org/stable/c/c1a3803e5bb91c13e9ad582003e4288f67f06cd9 - Patch
References () https://git.kernel.org/stable/c/ece3fc1c10197052044048bea4f13cfdcf25b416 - () https://git.kernel.org/stable/c/ece3fc1c10197052044048bea4f13cfdcf25b416 - Patch

10 Apr 2025, 13:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/963523600d9f1e36bc35ba774c2493d6baa4dd8f -
  • () https://git.kernel.org/stable/c/ece3fc1c10197052044048bea4f13cfdcf25b416 -

07 Apr 2025, 09:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/04d1086a62ac492ebb6bb0c94c1c8cb55f5d1f36 -

21 Nov 2024, 09:26

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/43fff07e4b1956d0e5cf23717507e438278ea3d9 - () https://git.kernel.org/stable/c/43fff07e4b1956d0e5cf23717507e438278ea3d9 -
References () https://git.kernel.org/stable/c/545b215736c5c4b354e182d99c578a472ac9bfce - () https://git.kernel.org/stable/c/545b215736c5c4b354e182d99c578a472ac9bfce -
References () https://git.kernel.org/stable/c/904db2ba44ae60641b6378c5013254d09acf5e80 - () https://git.kernel.org/stable/c/904db2ba44ae60641b6378c5013254d09acf5e80 -
References () https://git.kernel.org/stable/c/c1a3803e5bb91c13e9ad582003e4288f67f06cd9 - () https://git.kernel.org/stable/c/c1a3803e5bb91c13e9ad582003e4288f67f06cd9 -

20 Jun 2024, 12:43

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: medios: i2c: et8ek8: No eliminar la función de eliminación cuando el controlador está integrado. El uso de __exit para la función de eliminación hace que la devolución de llamada de eliminación se descarte con CONFIG_VIDEO_ET8EK8=y. Cuando un dispositivo de este tipo se desvincula (por ejemplo, usando sysfs o hotplug), el controlador simplemente se elimina sin que se realice la limpieza. Esto da como resultado fugas de recursos. Solucionarlo compilando la devolución de llamada de eliminación incondicionalmente. Esto también corrige una advertencia de modpost W=1: ADVERTENCIA: modpost: drivers/media/i2c/et8ek8/et8ek8: sección no coincide en referencia: et8ek8_i2c_driver+0x10 (sección: .data) -> et8ek8_remove (sección: .exit.text)

19 Jun 2024, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-19 14:15

Updated : 2025-11-03 20:16

NVD link : CVE-2024-38611

Mitre link : CVE-2024-38611

CVE.ORG link : CVE-2024-38611

JSON object : View

Products Affected

linux

CWE
CWE-401

Missing Release of Memory after Effective Lifetime