Vulnerability-Lookup

CNVD-2024-33412

Vulnerability from cnvd - Published: 2024-07-25

Title

Linux kernel堆溢出漏洞

Description

Linux kernel是一款操作系统的核心组件，提供系统调用、硬件驱动管理等功能。作为现代计算机的运行基石，Linux kernel不仅稳定可靠，而且具有极高的灵活性和可定制性。 Linux kernel存在堆溢出漏洞。攻击者可以利用该漏洞通过构造特殊字符触发堆溢出，导致拒绝服务。

Severity

中

Patch Name

Linux内核堆溢出漏洞的补丁

Patch Description

Linux内核是一款操作系统的核心组件，提供系统调用、硬件驱动管理等功能。作为现代计算机的运行基石，Linux内核不仅稳定可靠，而且具有极高的灵活性和可定制性。 Linux内核存在堆溢出漏洞。攻击者可以利用该漏洞通过构造特殊字符触发堆溢出，导致拒绝服务。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://git.kernel.org/stable/c/5bc9de065b8bb9b8dd8799ecb4592d0403b54281

Reference

https://nvd.nist.gov/vuln/detail/CVE-2024-39479

Impacted products

Name
['Linux Linux kernel >=6.6，< 6.6.34', 'Linux Linux kernel >=6.9，<6.9.5']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2024-39479",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-39479"
    }
  },
  "description": "Linux kernel\u662f\u4e00\u6b3e\u64cd\u4f5c\u7cfb\u7edf\u7684\u6838\u5fc3\u7ec4\u4ef6\uff0c\u63d0\u4f9b\u7cfb\u7edf\u8c03\u7528\u3001\u786c\u4ef6\u9a71\u52a8\u7ba1\u7406\u7b49\u529f\u80fd\u3002\u4f5c\u4e3a\u73b0\u4ee3\u8ba1\u7b97\u673a\u7684\u8fd0\u884c\u57fa\u77f3\uff0cLinux kernel\u4e0d\u4ec5\u7a33\u5b9a\u53ef\u9760\uff0c\u800c\u4e14\u5177\u6709\u6781\u9ad8\u7684\u7075\u6d3b\u6027\u548c\u53ef\u5b9a\u5236\u6027\u3002\n\nLinux kernel\u5b58\u5728\u5806\u6ea2\u51fa\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u6784\u9020\u7279\u6b8a\u5b57\u7b26\u89e6\u53d1\u5806\u6ea2\u51fa\uff0c\u5bfc\u81f4\u62d2\u7edd\u670d\u52a1\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://git.kernel.org/stable/c/5bc9de065b8bb9b8dd8799ecb4592d0403b54281",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2024-33412",
  "openTime": "2024-07-25",
  "patchDescription": "Linux\u5185\u6838\u662f\u4e00\u6b3e\u64cd\u4f5c\u7cfb\u7edf\u7684\u6838\u5fc3\u7ec4\u4ef6\uff0c\u63d0\u4f9b\u7cfb\u7edf\u8c03\u7528\u3001\u786c\u4ef6\u9a71\u52a8\u7ba1\u7406\u7b49\u529f\u80fd\u3002\u4f5c\u4e3a\u73b0\u4ee3\u8ba1\u7b97\u673a\u7684\u8fd0\u884c\u57fa\u77f3\uff0cLinux\u5185\u6838\u4e0d\u4ec5\u7a33\u5b9a\u53ef\u9760\uff0c\u800c\u4e14\u5177\u6709\u6781\u9ad8\u7684\u7075\u6d3b\u6027\u548c\u53ef\u5b9a\u5236\u6027\u3002\r\n\r\nLinux\u5185\u6838\u5b58\u5728\u5806\u6ea2\u51fa\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u6784\u9020\u7279\u6b8a\u5b57\u7b26\u89e6\u53d1\u5806\u6ea2\u51fa\uff0c\u5bfc\u81f4\u62d2\u7edd\u670d\u52a1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Linux\u5185\u6838\u5806\u6ea2\u51fa\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Linux Linux kernel \u003e=6.6\uff0c\u003c 6.6.34",
      "Linux Linux kernel \u003e=6.9\uff0c\u003c6.9.5"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2024-39479",
  "serverity": "\u4e2d",
  "submitTime": "2024-07-11",
  "title": "Linux kernel\u5806\u6ea2\u51fa\u6f0f\u6d1e"
}

CVE-2024-39479 (GCVE-0-2024-39479)

Vulnerability from cvelistv5 – Published: 2024-07-05 06:55 – Updated: 2026-08-05 11:33

Title

drm/i915/hwmon: Get rid of devm

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/i915/hwmon: Get rid of devm When both hwmon and hwmon drvdata (on which hwmon depends) are device managed resources, the expectation, on device unbind, is that hwmon will be released before drvdata. However, in i915 there are two separate code paths, which both release either drvdata or hwmon and either can be released before the other. These code paths (for device unbind) are as follows (see also the bug referenced below): Call Trace: release_nodes+0x11/0x70 devres_release_group+0xb2/0x110 component_unbind_all+0x8d/0xa0 component_del+0xa5/0x140 intel_pxp_tee_component_fini+0x29/0x40 [i915] intel_pxp_fini+0x33/0x80 [i915] i915_driver_remove+0x4c/0x120 [i915] i915_pci_remove+0x19/0x30 [i915] pci_device_remove+0x32/0xa0 device_release_driver_internal+0x19c/0x200 unbind_store+0x9c/0xb0 and Call Trace: release_nodes+0x11/0x70 devres_release_all+0x8a/0xc0 device_unbind_cleanup+0x9/0x70 device_release_driver_internal+0x1c1/0x200 unbind_store+0x9c/0xb0 This means that in i915, if use devm, we cannot gurantee that hwmon will always be released before drvdata. Which means that we have a uaf if hwmon sysfs is accessed when drvdata has been released but hwmon hasn't. The only way out of this seems to be do get rid of devm_ and release/free everything explicitly during device unbind. v2: Change commit message and other minor code changes v3: Cleanup from i915_hwmon_register on error (Armin Wolf) v4: Eliminate potential static analyzer warning (Rodrigo) Eliminate fetch_and_zero (Jani) v5: Restore previous logic for ddat_gt->hwmon_dev error return (Andi)

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-07-05 14:32 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/cfa73607eb21a4ce1…
https://git.kernel.org/stable/c/ce5a22d22db691d14…
https://git.kernel.org/stable/c/5bc9de065b8bb9b8d…

Impacted products

3 products

Vendor	Product	Version
Linux	Linux	Affected: b3b088e28183b84080b7f0a0b8da84ec42b4b0e8 , < cfa73607eb21a4ce1d6294a2c5733628897b48a2 (git) Affected: b3b088e28183b84080b7f0a0b8da84ec42b4b0e8 , < ce5a22d22db691d14516c3b8fdbf69139eb2ea8f (git) Affected: b3b088e28183b84080b7f0a0b8da84ec42b4b0e8 , < 5bc9de065b8bb9b8dd8799ecb4592d0403b54281 (git)
Linux	Linux	Affected: 6.2 Unaffected: 0 , < 6.2 (semver) Unaffected: 6.6.34 , ≤ 6.6.* (semver) Unaffected: 6.9.5 , ≤ 6.9.* (semver) Unaffected: 6.10 , ≤ * (original_commit_for_fix)
linux	linux_kernel	Affected: 1da177e4c3f4 , < cfa73607eb21 (custom) Affected: 1da177e4c3f4 , < ce5a22d22db6 (custom) Affected: 1da177e4c3f4 , < 5bc9de065b8b (custom) Unaffected: 6.6.34 , ≤ 6.7 (custom) Unaffected: 6.95 , ≤ 6.10 (custom) Unaffected: 6.10-rc1 cpe:2.3:o:linux:linux_kernel:-:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "cfa73607eb21",
                "status": "affected",
                "version": "1da177e4c3f4",
                "versionType": "custom"
              },
              {
                "lessThan": "ce5a22d22db6",
                "status": "affected",
                "version": "1da177e4c3f4",
                "versionType": "custom"
              },
              {
                "lessThan": "5bc9de065b8b",
                "status": "affected",
                "version": "1da177e4c3f4",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "6.7",
                "status": "unaffected",
                "version": "6.6.34",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "6.10",
                "status": "unaffected",
                "version": "6.95",
                "versionType": "custom"
              },
              {
                "status": "unaffected",
                "version": "6.10-rc1"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-39479",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-05T14:32:43.637731Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T14:38:39.208Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:26:15.833Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/cfa73607eb21a4ce1d6294a2c5733628897b48a2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ce5a22d22db691d14516c3b8fdbf69139eb2ea8f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5bc9de065b8bb9b8dd8799ecb4592d0403b54281"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/i915_hwmon.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cfa73607eb21a4ce1d6294a2c5733628897b48a2",
              "status": "affected",
              "version": "b3b088e28183b84080b7f0a0b8da84ec42b4b0e8",
              "versionType": "git"
            },
            {
              "lessThan": "ce5a22d22db691d14516c3b8fdbf69139eb2ea8f",
              "status": "affected",
              "version": "b3b088e28183b84080b7f0a0b8da84ec42b4b0e8",
              "versionType": "git"
            },
            {
              "lessThan": "5bc9de065b8bb9b8dd8799ecb4592d0403b54281",
              "status": "affected",
              "version": "b3b088e28183b84080b7f0a0b8da84ec42b4b0e8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/i915_hwmon.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.34",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.5",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/hwmon: Get rid of devm\n\nWhen both hwmon and hwmon drvdata (on which hwmon depends) are device\nmanaged resources, the expectation, on device unbind, is that hwmon will be\nreleased before drvdata. However, in i915 there are two separate code\npaths, which both release either drvdata or hwmon and either can be\nreleased before the other. These code paths (for device unbind) are as\nfollows (see also the bug referenced below):\n\nCall Trace:\nrelease_nodes+0x11/0x70\ndevres_release_group+0xb2/0x110\ncomponent_unbind_all+0x8d/0xa0\ncomponent_del+0xa5/0x140\nintel_pxp_tee_component_fini+0x29/0x40 [i915]\nintel_pxp_fini+0x33/0x80 [i915]\ni915_driver_remove+0x4c/0x120 [i915]\ni915_pci_remove+0x19/0x30 [i915]\npci_device_remove+0x32/0xa0\ndevice_release_driver_internal+0x19c/0x200\nunbind_store+0x9c/0xb0\n\nand\n\nCall Trace:\nrelease_nodes+0x11/0x70\ndevres_release_all+0x8a/0xc0\ndevice_unbind_cleanup+0x9/0x70\ndevice_release_driver_internal+0x1c1/0x200\nunbind_store+0x9c/0xb0\n\nThis means that in i915, if use devm, we cannot gurantee that hwmon will\nalways be released before drvdata. Which means that we have a uaf if hwmon\nsysfs is accessed when drvdata has been released but hwmon hasn\u0027t.\n\nThe only way out of this seems to be do get rid of devm_ and release/free\neverything explicitly during device unbind.\n\nv2: Change commit message and other minor code changes\nv3: Cleanup from i915_hwmon_register on error (Armin Wolf)\nv4: Eliminate potential static analyzer warning (Rodrigo)\n    Eliminate fetch_and_zero (Jani)\nv5: Restore previous logic for ddat_gt-\u003ehwmon_dev error return (Andi)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached by reading an i915 hwmon sysfs attribute (`/sys/class/hwmon/hwmonN/energy1_input`) on the local machine; no network or remote peer data is involved, and the heap grooming needed to weaponize the UAF also requires local execution.\nAC:L - The freed-object window is opened only by driver unbind, module removal, or PCI hot-remove \u2014 an administrative event an unprivileged attacker cannot cause \u2014 but once it occurs the attacker does not need to win a tight timing race: the hwmon sysfs nodes stay registered and readable across the entire teardown interval, so a zero-cost busy-read loop lands in the window deterministically. Choosing the higher-severity option where the two readings are defensible.\nPR:L - `energy1_input`, `in0_input` and `power1_rated_max` are mode 0444 and `power1_max_interval` is 0664, so any local unprivileged account can open and read them with no capability check anywhere on the path from `sysfs_kf_seq_show` down to `hwm_energy()`.\nUI:N - The attacker\u0027s read requires no victim action \u2014 no file must be opened on the victim\u0027s behalf, no media mounted; the driver unbind is a system/administrative event already accounted for in Attack Complexity, not exploit-time user participation.\nS:U - The use-after-free corrupts kernel heap memory within the same security authority as the kernel itself; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free on a ~400-byte `kmalloc-512` object: `hwmon-\u003erg.energy_status_*` and `rg.pkg_rapl_limit` are read from freed memory and used as MMIO offsets, and `ddat-\u003euncore` is a fully dereferenced stale pointer, so an attacker who reclaims the slot with controlled data obtains an arbitrary kernel/MMIO read reflected back through sysfs.\nI:H - `hwm_energy()` writes into the freed object (`ei-\u003eaccum_energy`, `ei-\u003ereg_val_prev`, and `mutex_lock(\u0026hwmon-\u003ehwmon_lock)`), and `intel_uncore_read()` performs an indirect call through `uncore-\u003efuncs.mmio_readl` loaded out of the freed allocation \u2014 a control-flow hijack primitive once the slab is reclaimed with attacker-influenced contents.\nA:H - Even unweaponized, dereferencing the freed `struct i915_hwmon` and the stale `ddat-\u003euncore` function-pointer table oopses the kernel; this is the reported symptom in the referenced Freedesktop bug, and it can be re-triggered on every unbind."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:33:32.923Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cfa73607eb21a4ce1d6294a2c5733628897b48a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce5a22d22db691d14516c3b8fdbf69139eb2ea8f"
        },
        {
          "url": "https://git.kernel.org/stable/c/5bc9de065b8bb9b8dd8799ecb4592d0403b54281"
        }
      ],
      "title": "drm/i915/hwmon: Get rid of devm",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-39479",
    "datePublished": "2024-07-05T06:55:08.597Z",
    "dateReserved": "2024-06-25T14:23:23.746Z",
    "dateUpdated": "2026-08-05T11:33:32.923Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.