CVE-2024-40919

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-40919

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send() In case of token is released due to token->state == BNXT_HWRM_DEFERRED, released token (set to NULL) is used in log messages. This issue is expected to be prevented by HWRM_ERR_CODE_PF_UNAVAILABLE error code. But this error code is returned by recent firmware. So some firmware may not return it. This may lead to NULL pointer dereference. Adjust this issue by adding token pointer check. Found by Linux Verification Center (linuxtesting.org) with SVACE.

References
Link Resource
https://git.kernel.org/stable/c/8b65eaeae88d4e9f999e806e196dd887b90bfed9 Patch
https://git.kernel.org/stable/c/a9b9741854a9fe9df948af49ca5514e0ed0429df Patch
https://git.kernel.org/stable/c/ca6660c956242623b4cfe9be2a1abc67907c44bf Patch
https://git.kernel.org/stable/c/cde177fa235cd36f981012504a6376315bac03c9 Patch
https://git.kernel.org/stable/c/8b65eaeae88d4e9f999e806e196dd887b90bfed9 Patch
https://git.kernel.org/stable/c/a9b9741854a9fe9df948af49ca5514e0ed0429df Patch
https://git.kernel.org/stable/c/ca6660c956242623b4cfe9be2a1abc67907c44bf Patch
https://git.kernel.org/stable/c/cde177fa235cd36f981012504a6376315bac03c9 Patch
https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*
History

03 Nov 2025, 22:17

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html -

03 Feb 2025, 15:36

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-476
CPE cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*
First Time Linux linux Kernel
Linux
References () https://git.kernel.org/stable/c/8b65eaeae88d4e9f999e806e196dd887b90bfed9 - () https://git.kernel.org/stable/c/8b65eaeae88d4e9f999e806e196dd887b90bfed9 - Patch
References () https://git.kernel.org/stable/c/a9b9741854a9fe9df948af49ca5514e0ed0429df - () https://git.kernel.org/stable/c/a9b9741854a9fe9df948af49ca5514e0ed0429df - Patch
References () https://git.kernel.org/stable/c/ca6660c956242623b4cfe9be2a1abc67907c44bf - () https://git.kernel.org/stable/c/ca6660c956242623b4cfe9be2a1abc67907c44bf - Patch
References () https://git.kernel.org/stable/c/cde177fa235cd36f981012504a6376315bac03c9 - () https://git.kernel.org/stable/c/cde177fa235cd36f981012504a6376315bac03c9 - Patch

21 Nov 2024, 09:31

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/8b65eaeae88d4e9f999e806e196dd887b90bfed9 - () https://git.kernel.org/stable/c/8b65eaeae88d4e9f999e806e196dd887b90bfed9 -
References () https://git.kernel.org/stable/c/a9b9741854a9fe9df948af49ca5514e0ed0429df - () https://git.kernel.org/stable/c/a9b9741854a9fe9df948af49ca5514e0ed0429df -
References () https://git.kernel.org/stable/c/ca6660c956242623b4cfe9be2a1abc67907c44bf - () https://git.kernel.org/stable/c/ca6660c956242623b4cfe9be2a1abc67907c44bf -
References () https://git.kernel.org/stable/c/cde177fa235cd36f981012504a6376315bac03c9 - () https://git.kernel.org/stable/c/cde177fa235cd36f981012504a6376315bac03c9 -
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bnxt_en: Ajusta el registro de mensajes de firmware en caso de token liberado en __hwrm_send() En caso de que el token se libere debido al token->estado == BNXT_HWRM_DEFERRED, token liberado (establecido en NULL ) se utiliza en mensajes de registro. Se espera que este problema se evite mediante el código de error HWRM_ERR_CODE_PF_UNAVAILABLE. Pero este código de error lo devuelve un firmware reciente. Por lo tanto, es posible que algunos firmware no lo devuelvan. Esto puede provocar una desreferencia del puntero NULL. Ajuste este problema agregando una verificación del puntero del token. Encontrado por el Centro de verificación de Linux (linuxtesting.org) con SVACE.

12 Jul 2024, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-12 13:15

Updated : 2025-11-03 22:17

NVD link : CVE-2024-40919

Mitre link : CVE-2024-40919

CVE.ORG link : CVE-2024-40919

JSON object : View

Products Affected

linux

CWE
CWE-476

NULL Pointer Dereference