GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-35811 (GCVE-0-2024-35811)

Vulnerability from cvelistv5 – Published: 2024-05-17 13:23 – Updated: 2026-08-05 11:30
VLAI
Title
wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach This is the candidate patch of CVE-2023-47233 : https://nvd.nist.gov/vuln/detail/CVE-2023-47233 In brcm80211 driver,it starts with the following invoking chain to start init a timeout worker: ->brcmf_usb_probe ->brcmf_usb_probe_cb ->brcmf_attach ->brcmf_bus_started ->brcmf_cfg80211_attach ->wl_init_priv ->brcmf_init_escan ->INIT_WORK(&cfg->escan_timeout_work, brcmf_cfg80211_escan_timeout_worker); If we disconnect the USB by hotplug, it will call brcmf_usb_disconnect to make cleanup. The invoking chain is : brcmf_usb_disconnect ->brcmf_usb_disconnect_cb ->brcmf_detach ->brcmf_cfg80211_detach ->kfree(cfg); While the timeout woker may still be running. This will cause a use-after-free bug on cfg in brcmf_cfg80211_escan_timeout_worker. Fix it by deleting the timer and canceling the worker in brcmf_cfg80211_detach. [arend.vanspriel@broadcom.com: keep timer delete as is and cancel work just before free]
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 15:42 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e756af5b30b008f6ffcfebf8ad0b477f6f225b62 , < 202c503935042272e2f9e1bb549d5f69a8681169 (git)
Affected: e756af5b30b008f6ffcfebf8ad0b477f6f225b62 , < 8e3f03f4ef7c36091f46e7349096efb5a2cdb3a1 (git)
Affected: e756af5b30b008f6ffcfebf8ad0b477f6f225b62 , < bacb8c3ab86dcd760c15903fcee58169bc3026aa (git)
Affected: e756af5b30b008f6ffcfebf8ad0b477f6f225b62 , < 8c36205123dc57349b59b4f1a2301eb278cbc731 (git)
Affected: e756af5b30b008f6ffcfebf8ad0b477f6f225b62 , < 0b812f706fd7090be74812101114a0e165b36744 (git)
Affected: e756af5b30b008f6ffcfebf8ad0b477f6f225b62 , < 190794848e2b9d15de92d502b6ac652806904f5a (git)
Affected: e756af5b30b008f6ffcfebf8ad0b477f6f225b62 , < 6678a1e7d896c00030b31491690e8ddc9a90767a (git)
Affected: e756af5b30b008f6ffcfebf8ad0b477f6f225b62 , < 0a7591e14a8da794d0b93b5d1c6254ccb23adacb (git)
Affected: e756af5b30b008f6ffcfebf8ad0b477f6f225b62 , < 0f7352557a35ab7888bc7831411ec8a3cbe20d78 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.7
Unaffected: 0 , < 3.7 (semver)
Unaffected: 4.19.312 , ≤ 4.19.* (semver)
Unaffected: 5.4.274 , ≤ 5.4.* (semver)
Unaffected: 5.10.215 , ≤ 5.10.* (semver)
Unaffected: 5.15.154 , ≤ 5.15.* (semver)
Unaffected: 6.1.84 , ≤ 6.1.* (semver)
Unaffected: 6.6.24 , ≤ 6.6.* (semver)
Unaffected: 6.7.12 , ≤ 6.7.* (semver)
Unaffected: 6.8.3 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem Affected: 0 , < * (custom)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:47.516Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/202c503935042272e2f9e1bb549d5f69a8681169"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8e3f03f4ef7c36091f46e7349096efb5a2cdb3a1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bacb8c3ab86dcd760c15903fcee58169bc3026aa"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8c36205123dc57349b59b4f1a2301eb278cbc731"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0b812f706fd7090be74812101114a0e165b36744"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/190794848e2b9d15de92d502b6ac652806904f5a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6678a1e7d896c00030b31491690e8ddc9a90767a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0a7591e14a8da794d0b93b5d1c6254ccb23adacb"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0f7352557a35ab7888bc7831411ec8a3cbe20d78"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35811",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:42:35.275433Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:32:51.552Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T11:52:09.242Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "202c503935042272e2f9e1bb549d5f69a8681169",
              "status": "affected",
              "version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62",
              "versionType": "git"
            },
            {
              "lessThan": "8e3f03f4ef7c36091f46e7349096efb5a2cdb3a1",
              "status": "affected",
              "version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62",
              "versionType": "git"
            },
            {
              "lessThan": "bacb8c3ab86dcd760c15903fcee58169bc3026aa",
              "status": "affected",
              "version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62",
              "versionType": "git"
            },
            {
              "lessThan": "8c36205123dc57349b59b4f1a2301eb278cbc731",
              "status": "affected",
              "version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62",
              "versionType": "git"
            },
            {
              "lessThan": "0b812f706fd7090be74812101114a0e165b36744",
              "status": "affected",
              "version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62",
              "versionType": "git"
            },
            {
              "lessThan": "190794848e2b9d15de92d502b6ac652806904f5a",
              "status": "affected",
              "version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62",
              "versionType": "git"
            },
            {
              "lessThan": "6678a1e7d896c00030b31491690e8ddc9a90767a",
              "status": "affected",
              "version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62",
              "versionType": "git"
            },
            {
              "lessThan": "0a7591e14a8da794d0b93b5d1c6254ccb23adacb",
              "status": "affected",
              "version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62",
              "versionType": "git"
            },
            {
              "lessThan": "0f7352557a35ab7888bc7831411ec8a3cbe20d78",
              "status": "affected",
              "version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.7"
            },
            {
              "lessThan": "3.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.312",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.274",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.215",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.84",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.312",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.274",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.215",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.154",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.84",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.24",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.12",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.3",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach\n\nThis is the candidate patch of CVE-2023-47233 :\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-47233\n\nIn brcm80211 driver,it starts with the following invoking chain\nto start init a timeout worker:\n\n-\u003ebrcmf_usb_probe\n  -\u003ebrcmf_usb_probe_cb\n    -\u003ebrcmf_attach\n      -\u003ebrcmf_bus_started\n        -\u003ebrcmf_cfg80211_attach\n          -\u003ewl_init_priv\n            -\u003ebrcmf_init_escan\n              -\u003eINIT_WORK(\u0026cfg-\u003eescan_timeout_work,\n\t\t  brcmf_cfg80211_escan_timeout_worker);\n\nIf we disconnect the USB by hotplug, it will call\nbrcmf_usb_disconnect to make cleanup. The invoking chain is :\n\nbrcmf_usb_disconnect\n  -\u003ebrcmf_usb_disconnect_cb\n    -\u003ebrcmf_detach\n      -\u003ebrcmf_cfg80211_detach\n        -\u003ekfree(cfg);\n\nWhile the timeout woker may still be running. This will cause\na use-after-free bug on cfg in brcmf_cfg80211_escan_timeout_worker.\n\nFix it by deleting the timer and canceling the worker in\nbrcmf_cfg80211_detach.\n\n[arend.vanspriel@broadcom.com: keep timer delete as is and cancel work just before free]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable free/use race is in a WiFi driver and is reached automatically via the firmware-crash recovery path (`brcmf_fw_crashed()` \u2192 `bus_reset` work \u2192 `brcmf_pcie_reset`/`brcmf_sdio_bus_reset` \u2192 `brcmf_detach` \u2192 `brcmf_cfg80211_detach` \u2192 `kfree(cfg)`), while the escan timeout worker fires precisely because the firmware stopped responding mid-scan. An adjacent 802.11 attacker who induces a firmware halt (a well-documented failure mode of Broadcom fullmac firmware when fed malformed frames) while the station is doing its routine background scanning triggers both sides of the race over the air.\nAC:L - The attacker controls both halves of the race \u2014 the stalled scan that guarantees the 10 s escan timer expires and the firmware halt that drives the detach \u2014 and the window is wide because the worker blocks in `brcmf_fil_cmd_data_set()` waiting on a dead firmware while `brcmf_cfg80211_detach()` frees `escan_buf` and `cfg` in parallel. The attempt is freely repeatable, and heap grooming of the freed 65000-byte buffer and `cfg` slab is standard.\nPR:N - No local account or capability is needed on the affected system: the scan is issued by the normal background supplicant/NetworkManager activity, and the detach is performed autonomously by the driver\u0027s bus-reset recovery worker in response to a firmware halt. The originally reported USB-hotplug variant likewise requires no privileges.\nUI:N - Background scanning by wpa_supplicant/NetworkManager is continuous and automatic, and the `brcmf_fw_crashed()` \u2192 bus-reset \u2192 detach sequence runs entirely inside the kernel without any user action. No victim interaction is required at any point.\nS:U - The use-after-free corrupts kernel heap objects and is exploited within the kernel\u0027s own security authority, with no crossing of a hypervisor, IOMMU, or sandbox boundary. Impact remains confined to the kernel that owns the vulnerable component.\nC:H - After the free, `brcmf_inform_bss()` walks the dangling `escan_info.escan_buf` with a length/count taken from reallocated memory, giving controlled out-of-bounds reads, and `brcmf_inform_single_bss()` hands the resulting `notify_ie`/`notify_ielen` to `cfg80211_inform_bss_data()`, which copies that kernel memory into a BSS entry retrievable by userspace via nl80211. This is an arbitrary kernel-memory read with a direct exfiltration channel.\nI:H - The worker performs an indirect call through `cfg-\u003ed11inf.decchspec`, a function pointer loaded from the freed `cfg` object, giving control-flow hijack once the slab is reallocated with attacker-controlled data, and it also writes into freed memory (`bi-\u003ectl_ch`, `cfg-\u003escan_request = NULL`, `timer_delete_sync()` on a freed `timer_list`). Combined with the stale `ifp` and `scan_request` passed into further kernel calls, this yields write and code-execution primitives.\nA:H - Even without full exploitation, dereferencing the freed `cfg`, freed `escan_buf`, and freed `brcmf_if`, and running `timer_delete_sync()`/`cfg80211_scan_done()` on freed structures, reliably produces oopses, slab corruption, and kernel panic. The WiFi interface is destroyed and the system crashes."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:30:05.862Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/202c503935042272e2f9e1bb549d5f69a8681169"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e3f03f4ef7c36091f46e7349096efb5a2cdb3a1"
        },
        {
          "url": "https://git.kernel.org/stable/c/bacb8c3ab86dcd760c15903fcee58169bc3026aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/8c36205123dc57349b59b4f1a2301eb278cbc731"
        },
        {
          "url": "https://git.kernel.org/stable/c/0b812f706fd7090be74812101114a0e165b36744"
        },
        {
          "url": "https://git.kernel.org/stable/c/190794848e2b9d15de92d502b6ac652806904f5a"
        },
        {
          "url": "https://git.kernel.org/stable/c/6678a1e7d896c00030b31491690e8ddc9a90767a"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a7591e14a8da794d0b93b5d1c6254ccb23adacb"
        },
        {
          "url": "https://git.kernel.org/stable/c/0f7352557a35ab7888bc7831411ec8a3cbe20d78"
        }
      ],
      "title": "wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35811",
    "datePublished": "2024-05-17T13:23:17.508Z",
    "dateReserved": "2024-05-17T12:19:12.342Z",
    "dateUpdated": "2026-08-05T11:30:05.862Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-35811",
      "date": "2026-09-16",
      "epss": "0.00353",
      "percentile": "0.28805"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.7\", \"versionEndExcluding\": \"4.19.312\", \"matchCriteriaId\": \"48A978A1-082D-4FD8-B0A8-15D857F7935B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.20\", \"versionEndExcluding\": \"5.4.274\", \"matchCriteriaId\": \"F45A0F3C-C16D-49C4-86D6-D021C3D4B834\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.5\", \"versionEndExcluding\": \"5.10.215\", \"matchCriteriaId\": \"9CD5894E-58E9-4B4A-B0F4-3E6BC134B8F5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.11\", \"versionEndExcluding\": \"5.15.154\", \"matchCriteriaId\": \"577E212E-7E95-4A71-9B5C-F1D1A3AFFF46\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"6.1.84\", \"matchCriteriaId\": \"834D9BD5-42A6-4D74-979E-4D6D93F630FD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.24\", \"matchCriteriaId\": \"8018C1D0-0A5F-48D0-BC72-A2B33FDDA693\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.7.12\", \"matchCriteriaId\": \"6BE9771A-BAFD-4624-95F9-58D536540C53\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.8\", \"versionEndExcluding\": \"6.8.3\", \"matchCriteriaId\": \"4C59BBC3-6495-4A77-9C82-55EC7CDF5E02\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach\\n\\nThis is the candidate patch of CVE-2023-47233 :\\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-47233\\n\\nIn brcm80211 driver,it starts with the following invoking chain\\nto start init a timeout worker:\\n\\n-\u003ebrcmf_usb_probe\\n  -\u003ebrcmf_usb_probe_cb\\n    -\u003ebrcmf_attach\\n      -\u003ebrcmf_bus_started\\n        -\u003ebrcmf_cfg80211_attach\\n          -\u003ewl_init_priv\\n            -\u003ebrcmf_init_escan\\n              -\u003eINIT_WORK(\u0026cfg-\u003eescan_timeout_work,\\n\\t\\t  brcmf_cfg80211_escan_timeout_worker);\\n\\nIf we disconnect the USB by hotplug, it will call\\nbrcmf_usb_disconnect to make cleanup. The invoking chain is :\\n\\nbrcmf_usb_disconnect\\n  -\u003ebrcmf_usb_disconnect_cb\\n    -\u003ebrcmf_detach\\n      -\u003ebrcmf_cfg80211_detach\\n        -\u003ekfree(cfg);\\n\\nWhile the timeout woker may still be running. This will cause\\na use-after-free bug on cfg in brcmf_cfg80211_escan_timeout_worker.\\n\\nFix it by deleting the timer and canceling the worker in\\nbrcmf_cfg80211_detach.\\n\\n[arend.vanspriel@broadcom.com: keep timer delete as is and cancel work just before free]\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: brcmfmac: corregido el error de use after free en brcmf_cfg80211_detach Este es el parche candidato de CVE-2023-47233: https://nvd.nist.gov/vuln/detail /CVE-2023-47233 En el controlador brcm80211, comienza con la siguiente cadena de invocaci\\u00f3n para iniciar un trabajador de tiempo de espera: -\u0026gt;brcmf_usb_probe -\u0026gt;brcmf_usb_probe_cb -\u0026gt;brcmf_attach -\u0026gt;brcmf_bus_started -\u0026gt;brcmf_cfg80211_attach -\u0026gt;wl_init_priv -\u0026gt;brcmf_init_escan -\u0026gt;INIT_WORK(\u0026amp;cfg -\u0026gt;escan_timeout_work, brcmf_cfg80211_escan_timeout_worker); Si desconectamos el USB mediante hotplug, llamar\\u00e1 a brcmf_usb_disconnect para realizar la limpieza. La cadena de invocaci\\u00f3n es: brcmf_usb_disconnect -\u0026gt;brcmf_usb_disconnect_cb -\u0026gt;brcmf_detach -\u0026gt;brcmf_cfg80211_detach -\u0026gt;kfree(cfg); Mientras que el activador de tiempo de espera a\\u00fan puede estar ejecut\\u00e1ndose. Esto provocar\\u00e1 un error de use after free en cfg en brcmf_cfg80211_escan_timeout_worker. Soluci\\u00f3nelo eliminando el temporizador y cancelando el trabajador en brcmf_cfg80211_detach. [arend.vanspriel@broadcom.com: mantenga la eliminaci\\u00f3n del temporizador tal como est\\u00e1 y cancele el trabajo justo antes de liberarlo]\"}]",
      "id": "CVE-2024-35811",
      "lastModified": "2025-01-14T14:23:38.660",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-05-17T14:15:15.177",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/0a7591e14a8da794d0b93b5d1c6254ccb23adacb\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/0b812f706fd7090be74812101114a0e165b36744\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/0f7352557a35ab7888bc7831411ec8a3cbe20d78\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/190794848e2b9d15de92d502b6ac652806904f5a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/202c503935042272e2f9e1bb549d5f69a8681169\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/6678a1e7d896c00030b31491690e8ddc9a90767a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/8c36205123dc57349b59b4f1a2301eb278cbc731\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/8e3f03f4ef7c36091f46e7349096efb5a2cdb3a1\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/bacb8c3ab86dcd760c15903fcee58169bc3026aa\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/0a7591e14a8da794d0b93b5d1c6254ccb23adacb\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/0b812f706fd7090be74812101114a0e165b36744\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/0f7352557a35ab7888bc7831411ec8a3cbe20d78\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/190794848e2b9d15de92d502b6ac652806904f5a\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/202c503935042272e2f9e1bb549d5f69a8681169\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/6678a1e7d896c00030b31491690e8ddc9a90767a\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/8c36205123dc57349b59b4f1a2301eb278cbc731\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/8e3f03f4ef7c36091f46e7349096efb5a2cdb3a1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/bacb8c3ab86dcd760c15903fcee58169bc3026aa\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-35811\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-17T14:15:15.177\",\"lastModified\":\"2026-08-04T11:17:55.300\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach\\n\\nThis is the candidate patch of CVE-2023-47233 :\\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-47233\\n\\nIn brcm80211 driver,it starts with the following invoking chain\\nto start init a timeout worker:\\n\\n-\u003ebrcmf_usb_probe\\n  -\u003ebrcmf_usb_probe_cb\\n    -\u003ebrcmf_attach\\n      -\u003ebrcmf_bus_started\\n        -\u003ebrcmf_cfg80211_attach\\n          -\u003ewl_init_priv\\n            -\u003ebrcmf_init_escan\\n              -\u003eINIT_WORK(\u0026cfg-\u003eescan_timeout_work,\\n\\t\\t  brcmf_cfg80211_escan_timeout_worker);\\n\\nIf we disconnect the USB by hotplug, it will call\\nbrcmf_usb_disconnect to make cleanup. The invoking chain is :\\n\\nbrcmf_usb_disconnect\\n  -\u003ebrcmf_usb_disconnect_cb\\n    -\u003ebrcmf_detach\\n      -\u003ebrcmf_cfg80211_detach\\n        -\u003ekfree(cfg);\\n\\nWhile the timeout woker may still be running. This will cause\\na use-after-free bug on cfg in brcmf_cfg80211_escan_timeout_worker.\\n\\nFix it by deleting the timer and canceling the worker in\\nbrcmf_cfg80211_detach.\\n\\n[arend.vanspriel@broadcom.com: keep timer delete as is and cancel work just before free]\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: brcmfmac: corregido el error de use after free en brcmf_cfg80211_detach Este es el parche candidato de CVE-2023-47233: https://nvd.nist.gov/vuln/detail /CVE-2023-47233 En el controlador brcm80211, comienza con la siguiente cadena de invocaci\u00f3n para iniciar un trabajador de tiempo de espera: -\u0026gt;brcmf_usb_probe -\u0026gt;brcmf_usb_probe_cb -\u0026gt;brcmf_attach -\u0026gt;brcmf_bus_started -\u0026gt;brcmf_cfg80211_attach -\u0026gt;wl_init_priv -\u0026gt;brcmf_init_escan -\u0026gt;INIT_WORK(\u0026amp;cfg -\u0026gt;escan_timeout_work, brcmf_cfg80211_escan_timeout_worker); Si desconectamos el USB mediante hotplug, llamar\u00e1 a brcmf_usb_disconnect para realizar la limpieza. La cadena de invocaci\u00f3n es: brcmf_usb_disconnect -\u0026gt;brcmf_usb_disconnect_cb -\u0026gt;brcmf_detach -\u0026gt;brcmf_cfg80211_detach -\u0026gt;kfree(cfg); Mientras que el activador de tiempo de espera a\u00fan puede estar ejecut\u00e1ndose. Esto provocar\u00e1 un error de use after free en cfg en brcmf_cfg80211_escan_timeout_worker. Soluci\u00f3nelo eliminando el temporizador y cancelando el trabajador en brcmf_cfg80211_detach. [arend.vanspriel@broadcom.com: mantenga la eliminaci\u00f3n del temporizador tal como est\u00e1 y cancele el trabajo justo antes de liberarlo]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e756af5b30b008f6ffcfebf8ad0b477f6f225b62\",\"lessThan\":\"202c503935042272e2f9e1bb549d5f69a8681169\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e756af5b30b008f6ffcfebf8ad0b477f6f225b62\",\"lessThan\":\"8e3f03f4ef7c36091f46e7349096efb5a2cdb3a1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e756af5b30b008f6ffcfebf8ad0b477f6f225b62\",\"lessThan\":\"bacb8c3ab86dcd760c15903fcee58169bc3026aa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e756af5b30b008f6ffcfebf8ad0b477f6f225b62\",\"lessThan\":\"8c36205123dc57349b59b4f1a2301eb278cbc731\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e756af5b30b008f6ffcfebf8ad0b477f6f225b62\",\"lessThan\":\"0b812f706fd7090be74812101114a0e165b36744\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e756af5b30b008f6ffcfebf8ad0b477f6f225b62\",\"lessThan\":\"190794848e2b9d15de92d502b6ac652806904f5a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e756af5b30b008f6ffcfebf8ad0b477f6f225b62\",\"lessThan\":\"6678a1e7d896c00030b31491690e8ddc9a90767a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e756af5b30b008f6ffcfebf8ad0b477f6f225b62\",\"lessThan\":\"0a7591e14a8da794d0b93b5d1c6254ccb23adacb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e756af5b30b008f6ffcfebf8ad0b477f6f225b62\",\"lessThan\":\"0f7352557a35ab7888bc7831411ec8a3cbe20d78\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.312\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.274\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.215\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.154\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.84\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.24\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.12\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.3\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T15:42:35.275433Z\",\"id\":\"CVE-2024-35811\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.7\",\"versionEndExcluding\":\"4.19.312\",\"matchCriteriaId\":\"48A978A1-082D-4FD8-B0A8-15D857F7935B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.274\",\"matchCriteriaId\":\"F45A0F3C-C16D-49C4-86D6-D021C3D4B834\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.215\",\"matchCriteriaId\":\"9CD5894E-58E9-4B4A-B0F4-3E6BC134B8F5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.154\",\"matchCriteriaId\":\"577E212E-7E95-4A71-9B5C-F1D1A3AFFF46\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.84\",\"matchCriteriaId\":\"834D9BD5-42A6-4D74-979E-4D6D93F630FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.24\",\"matchCriteriaId\":\"8018C1D0-0A5F-48D0-BC72-A2B33FDDA693\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.12\",\"matchCriteriaId\":\"6BE9771A-BAFD-4624-95F9-58D536540C53\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.8\",\"versionEndExcluding\":\"6.8.3\",\"matchCriteriaId\":\"4C59BBC3-6495-4A77-9C82-55EC7CDF5E02\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0a7591e14a8da794d0b93b5d1c6254ccb23adacb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0b812f706fd7090be74812101114a0e165b36744\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0f7352557a35ab7888bc7831411ec8a3cbe20d78\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/190794848e2b9d15de92d502b6ac652806904f5a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/202c503935042272e2f9e1bb549d5f69a8681169\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6678a1e7d896c00030b31491690e8ddc9a90767a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8c36205123dc57349b59b4f1a2301eb278cbc731\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8e3f03f4ef7c36091f46e7349096efb5a2cdb3a1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bacb8c3ab86dcd760c15903fcee58169bc3026aa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0a7591e14a8da794d0b93b5d1c6254ccb23adacb\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0b812f706fd7090be74812101114a0e165b36744\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0f7352557a35ab7888bc7831411ec8a3cbe20d78\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/190794848e2b9d15de92d502b6ac652806904f5a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/202c503935042272e2f9e1bb549d5f69a8681169\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6678a1e7d896c00030b31491690e8ddc9a90767a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8c36205123dc57349b59b4f1a2301eb278cbc731\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8e3f03f4ef7c36091f46e7349096efb5a2cdb3a1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bacb8c3ab86dcd760c15903fcee58169bc3026aa\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-265688.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:07:19+00:00",
      "cve": "CVE-2024-35811",
      "id": "CVE-2024-35811",
      "initial_release_date": "2024-05-17T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-35811.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T01:55:48Z",
      "cve": "CVE-2024-35811",
      "id": "CVE-2024-35811",
      "initial_release_date": "2024-05-21T02:00:11Z",
      "product_status:known_affected": "72",
      "product_status:known_not_affected": "41",
      "product_status:recommended": "917",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-35811",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-35811.json",
      "version": "82"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/202c503935042272e2f9e1bb549d5f69a8681169\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/8e3f03f4ef7c36091f46e7349096efb5a2cdb3a1\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/bacb8c3ab86dcd760c15903fcee58169bc3026aa\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/8c36205123dc57349b59b4f1a2301eb278cbc731\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0b812f706fd7090be74812101114a0e165b36744\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/190794848e2b9d15de92d502b6ac652806904f5a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/6678a1e7d896c00030b31491690e8ddc9a90767a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0a7591e14a8da794d0b93b5d1c6254ccb23adacb\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0f7352557a35ab7888bc7831411ec8a3cbe20d78\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:21:47.516Z\"}}, {\"affected\": [{\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"x_adpType\": \"supplier\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-265688.html\"}], \"providerMetadata\": {\"orgId\": \"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\", \"shortName\": \"siemens-SADP\", \"dateUpdated\": \"2026-05-12T11:52:09.242Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-35811\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:42:35.275433Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:13.106Z\"}}], \"cna\": {\"title\": \"wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:A - The vulnerable free/use race is in a WiFi driver and is reached automatically via the firmware-crash recovery path (`brcmf_fw_crashed()` \\u2192 `bus_reset` work \\u2192 `brcmf_pcie_reset`/`brcmf_sdio_bus_reset` \\u2192 `brcmf_detach` \\u2192 `brcmf_cfg80211_detach` \\u2192 `kfree(cfg)`), while the escan timeout worker fires precisely because the firmware stopped responding mid-scan. An adjacent 802.11 attacker who induces a firmware halt (a well-documented failure mode of Broadcom fullmac firmware when fed malformed frames) while the station is doing its routine background scanning triggers both sides of the race over the air.\\nAC:L - The attacker controls both halves of the race \\u2014 the stalled scan that guarantees the 10 s escan timer expires and the firmware halt that drives the detach \\u2014 and the window is wide because the worker blocks in `brcmf_fil_cmd_data_set()` waiting on a dead firmware while `brcmf_cfg80211_detach()` frees `escan_buf` and `cfg` in parallel. The attempt is freely repeatable, and heap grooming of the freed 65000-byte buffer and `cfg` slab is standard.\\nPR:N - No local account or capability is needed on the affected system: the scan is issued by the normal background supplicant/NetworkManager activity, and the detach is performed autonomously by the driver\u0027s bus-reset recovery worker in response to a firmware halt. The originally reported USB-hotplug variant likewise requires no privileges.\\nUI:N - Background scanning by wpa_supplicant/NetworkManager is continuous and automatic, and the `brcmf_fw_crashed()` \\u2192 bus-reset \\u2192 detach sequence runs entirely inside the kernel without any user action. No victim interaction is required at any point.\\nS:U - The use-after-free corrupts kernel heap objects and is exploited within the kernel\u0027s own security authority, with no crossing of a hypervisor, IOMMU, or sandbox boundary. Impact remains confined to the kernel that owns the vulnerable component.\\nC:H - After the free, `brcmf_inform_bss()` walks the dangling `escan_info.escan_buf` with a length/count taken from reallocated memory, giving controlled out-of-bounds reads, and `brcmf_inform_single_bss()` hands the resulting `notify_ie`/`notify_ielen` to `cfg80211_inform_bss_data()`, which copies that kernel memory into a BSS entry retrievable by userspace via nl80211. This is an arbitrary kernel-memory read with a direct exfiltration channel.\\nI:H - The worker performs an indirect call through `cfg-\u003ed11inf.decchspec`, a function pointer loaded from the freed `cfg` object, giving control-flow hijack once the slab is reallocated with attacker-controlled data, and it also writes into freed memory (`bi-\u003ectl_ch`, `cfg-\u003escan_request = NULL`, `timer_delete_sync()` on a freed `timer_list`). Combined with the stale `ifp` and `scan_request` passed into further kernel calls, this yields write and code-execution primitives.\\nA:H - Even without full exploitation, dereferencing the freed `cfg`, freed `escan_buf`, and freed `brcmf_if`, and running `timer_delete_sync()`/`cfg80211_scan_done()` on freed structures, reliably produces oopses, slab corruption, and kernel panic. The WiFi interface is destroyed and the system crashes.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"e756af5b30b008f6ffcfebf8ad0b477f6f225b62\", \"lessThan\": \"202c503935042272e2f9e1bb549d5f69a8681169\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e756af5b30b008f6ffcfebf8ad0b477f6f225b62\", \"lessThan\": \"8e3f03f4ef7c36091f46e7349096efb5a2cdb3a1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e756af5b30b008f6ffcfebf8ad0b477f6f225b62\", \"lessThan\": \"bacb8c3ab86dcd760c15903fcee58169bc3026aa\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e756af5b30b008f6ffcfebf8ad0b477f6f225b62\", \"lessThan\": \"8c36205123dc57349b59b4f1a2301eb278cbc731\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e756af5b30b008f6ffcfebf8ad0b477f6f225b62\", \"lessThan\": \"0b812f706fd7090be74812101114a0e165b36744\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e756af5b30b008f6ffcfebf8ad0b477f6f225b62\", \"lessThan\": \"190794848e2b9d15de92d502b6ac652806904f5a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e756af5b30b008f6ffcfebf8ad0b477f6f225b62\", \"lessThan\": \"6678a1e7d896c00030b31491690e8ddc9a90767a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e756af5b30b008f6ffcfebf8ad0b477f6f225b62\", \"lessThan\": \"0a7591e14a8da794d0b93b5d1c6254ccb23adacb\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e756af5b30b008f6ffcfebf8ad0b477f6f225b62\", \"lessThan\": \"0f7352557a35ab7888bc7831411ec8a3cbe20d78\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.312\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.274\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.215\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.154\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.84\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.24\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/202c503935042272e2f9e1bb549d5f69a8681169\"}, {\"url\": \"https://git.kernel.org/stable/c/8e3f03f4ef7c36091f46e7349096efb5a2cdb3a1\"}, {\"url\": \"https://git.kernel.org/stable/c/bacb8c3ab86dcd760c15903fcee58169bc3026aa\"}, {\"url\": \"https://git.kernel.org/stable/c/8c36205123dc57349b59b4f1a2301eb278cbc731\"}, {\"url\": \"https://git.kernel.org/stable/c/0b812f706fd7090be74812101114a0e165b36744\"}, {\"url\": \"https://git.kernel.org/stable/c/190794848e2b9d15de92d502b6ac652806904f5a\"}, {\"url\": \"https://git.kernel.org/stable/c/6678a1e7d896c00030b31491690e8ddc9a90767a\"}, {\"url\": \"https://git.kernel.org/stable/c/0a7591e14a8da794d0b93b5d1c6254ccb23adacb\"}, {\"url\": \"https://git.kernel.org/stable/c/0f7352557a35ab7888bc7831411ec8a3cbe20d78\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach\\n\\nThis is the candidate patch of CVE-2023-47233 :\\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-47233\\n\\nIn brcm80211 driver,it starts with the following invoking chain\\nto start init a timeout worker:\\n\\n-\u003ebrcmf_usb_probe\\n  -\u003ebrcmf_usb_probe_cb\\n    -\u003ebrcmf_attach\\n      -\u003ebrcmf_bus_started\\n        -\u003ebrcmf_cfg80211_attach\\n          -\u003ewl_init_priv\\n            -\u003ebrcmf_init_escan\\n              -\u003eINIT_WORK(\u0026cfg-\u003eescan_timeout_work,\\n\\t\\t  brcmf_cfg80211_escan_timeout_worker);\\n\\nIf we disconnect the USB by hotplug, it will call\\nbrcmf_usb_disconnect to make cleanup. The invoking chain is :\\n\\nbrcmf_usb_disconnect\\n  -\u003ebrcmf_usb_disconnect_cb\\n    -\u003ebrcmf_detach\\n      -\u003ebrcmf_cfg80211_detach\\n        -\u003ekfree(cfg);\\n\\nWhile the timeout woker may still be running. This will cause\\na use-after-free bug on cfg in brcmf_cfg80211_escan_timeout_worker.\\n\\nFix it by deleting the timer and canceling the worker in\\nbrcmf_cfg80211_detach.\\n\\n[arend.vanspriel@broadcom.com: keep timer delete as is and cancel work just before free]\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.312\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.274\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.215\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.154\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.84\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.24\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.12\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.3\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"3.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:30:05.862Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-35811\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:30:05.862Z\", \"dateReserved\": \"2024-05-17T12:19:12.342Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-17T13:23:17.508Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.