In the Linux kernel, the following vulnerability has been resolved:
wifi: brcmfmac: Fix use-after-free bug in brcmfcfg80211detach
This is the candidate patch of CVE-2023-47233 : https://nvd.nist.gov/vuln/detail/CVE-2023-47233
In brcm80211 driver,it starts with the following invoking chain to start init a timeout worker:
->brcmfusbprobe ->brcmfusbprobecb ->brcmfattach ->brcmfbusstarted ->brcmfcfg80211attach ->wlinitpriv ->brcmfinitescan ->INITWORK(&cfg->escantimeoutwork, brcmfcfg80211escantimeout_worker);
If we disconnect the USB by hotplug, it will call brcmfusbdisconnect to make cleanup. The invoking chain is :
brcmfusbdisconnect ->brcmfusbdisconnectcb ->brcmfdetach ->brcmfcfg80211detach ->kfree(cfg);
While the timeout woker may still be running. This will cause a use-after-free bug on cfg in brcmfcfg80211escantimeoutworker.
Fix it by deleting the timer and canceling the worker in brcmfcfg80211detach.
[arend.vanspriel@broadcom.com: keep timer delete as is and cancel work just before free]
[
{
"id": "CVE-2024-35811-2d5a6b10",
"target": {
"file": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"230072663310084089175982513313504748088",
"6259933212960945363759512439742590211",
"244027480212787933938087095833235155179",
"186935689991447824842317656401726188282",
"294411093551994592905846005751366575199",
"14037304564656292801416866304333892763",
"261938924265894917252525628797684902952",
"90882651980427162856622663185591640338",
"282610022381279507551684280526496726304"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0a7591e14a8da794d0b93b5d1c6254ccb23adacb",
"signature_version": "v1"
},
{
"id": "CVE-2024-35811-5105e117",
"target": {
"file": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c",
"function": "brcmf_notify_escan_complete"
},
"digest": {
"length": 1455.0,
"function_hash": "276945095490196561705739881625198981823"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0a7591e14a8da794d0b93b5d1c6254ccb23adacb",
"signature_version": "v1"
},
{
"id": "CVE-2024-35811-b025859a",
"target": {
"file": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c",
"function": "brcmf_cfg80211_detach"
},
"digest": {
"length": 204.0,
"function_hash": "172185116932255181406131961017411860839"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0a7591e14a8da794d0b93b5d1c6254ccb23adacb",
"signature_version": "v1"
}
]