7.8

CVE-2024-35856

Bluetooth: btusb: mediatek: Fix double free of skb in coredump

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btusb: mediatek: Fix double free of skb in coredump

hci_devcd_append() would free the skb on error so the caller don't
have to free it again otherwise it would cause the double free of skb.

Reported-by : Dan Carpenter <dan.carpenter@linaro.org>
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 6.6 < 6.6.30
Linux ≫ Linux Kernel Version >= 6.7 < 6.8.9
Linux ≫ Linux Kernel Version 6.9 Update rc1
Linux ≫ Linux Kernel Version 6.9 Update rc2
Linux ≫ Linux Kernel Version 6.9 Update rc3
Linux ≫ Linux Kernel Version 6.9 Update rc4
Linux ≫ Linux Kernel Version 6.9 Update rc5
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.37% 0.293
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
416baaa9-dc9f-4396-8d5f-8c081fb06d67 8.8 2.8 5.9
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-415 Double Free

The product calls free() twice on the same memory address.

https://git.kernel.org/stable/c/18bdb386a1a30e7a3d7732a98e45e69cf6b5710d
Patch
https://git.kernel.org/stable/c/80dfef128cb9f1b1ef67c0fe8c8deb4ea7ad30c1
Patch
https://git.kernel.org/stable/c/e20093c741d8da9f6390dd45d75b779861547035
Patch