CVE-2024-47666

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-47666

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: scsi: pm80xx: Set phy->enable_completion only when we wait for it pm8001_phy_control() populates the enable_completion pointer with a stack address, sends a PHY_LINK_RESET / PHY_HARD_RESET, waits 300 ms, and returns. The problem arises when a phy control response comes late. After 300 ms the pm8001_phy_control() function returns and the passed enable_completion stack address is no longer valid. Late phy control response invokes complete() on a dangling enable_completion pointer which leads to a kernel crash.

References
Link Resource
https://git.kernel.org/stable/c/7b1d779647afaea9185fa2f150b1721e7c1aae89 Patch
https://git.kernel.org/stable/c/a5d954802bda1aabcba49633cd94bad91c94113f
https://git.kernel.org/stable/c/ddc501f4130f4baa787cb6cfa309af697179f475
https://git.kernel.org/stable/c/e23ee0cc5bded07e700553aecc333bb20c768546
https://git.kernel.org/stable/c/e4f949ef1516c0d74745ee54a0f4882c1f6c7aea Patch
https://git.kernel.org/stable/c/f14d3e1aa613311c744af32d75125e95fc8ffb84 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

06 Dec 2025, 22:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/a5d954802bda1aabcba49633cd94bad91c94113f -
  • () https://git.kernel.org/stable/c/ddc501f4130f4baa787cb6cfa309af697179f475 -
  • () https://git.kernel.org/stable/c/e23ee0cc5bded07e700553aecc333bb20c768546 -

23 Oct 2024, 16:34

Type Values Removed Values Added
CWE CWE-416
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
First Time Linux
Linux linux Kernel
References () https://git.kernel.org/stable/c/7b1d779647afaea9185fa2f150b1721e7c1aae89 - () https://git.kernel.org/stable/c/7b1d779647afaea9185fa2f150b1721e7c1aae89 - Patch
References () https://git.kernel.org/stable/c/e4f949ef1516c0d74745ee54a0f4882c1f6c7aea - () https://git.kernel.org/stable/c/e4f949ef1516c0d74745ee54a0f4882c1f6c7aea - Patch
References () https://git.kernel.org/stable/c/f14d3e1aa613311c744af32d75125e95fc8ffb84 - () https://git.kernel.org/stable/c/f14d3e1aa613311c744af32d75125e95fc8ffb84 - Patch

10 Oct 2024, 12:51

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: scsi: pm80xx: Establecer phy->enable_completion solo cuando lo esperamos pm8001_phy_control() rellena el puntero enable_completion con una dirección de pila, envía un PHY_LINK_RESET / PHY_HARD_RESET, espera 300 ms y regresa. El problema surge cuando una respuesta de control phy llega tarde. Después de 300 ms, la función pm8001_phy_control() regresa y la dirección de pila enable_completion pasada ya no es válida. La respuesta de control phy tardía invoca complete() en un puntero enable_completion colgante que conduce a un bloqueo del kernel.

09 Oct 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-10-09 15:15

Updated : 2025-12-06 22:15

NVD link : CVE-2024-47666

Mitre link : CVE-2024-47666

CVE.ORG link : CVE-2024-47666

JSON object : View

Products Affected

linux

CWE
CWE-416

Use After Free