| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Fri, 17 May 2024 15:41:43 +0200 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org> Subject: CVE-2024-35828: wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer() Description =========== In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer() In the for statement of lbs_allocate_cmd_buffer(), if the allocation of cmdarray[i].cmdbuf fails, both cmdarray and cmdarray[i].cmdbuf needs to be freed. Otherwise, there will be memleaks in lbs_allocate_cmd_buffer(). The Linux kernel CVE team has assigned CVE-2024-35828 to this issue. Affected and fixed versions =========================== Issue introduced in 2.6.22 with commit 876c9d3aeb98 and fixed in 4.19.311 with commit 96481624fb5a Issue introduced in 2.6.22 with commit 876c9d3aeb98 and fixed in 5.4.273 with commit bea9573c795a Issue introduced in 2.6.22 with commit 876c9d3aeb98 and fixed in 5.10.214 with commit f0dd27314c7a Issue introduced in 2.6.22 with commit 876c9d3aeb98 and fixed in 5.15.153 with commit e888c4461e10 Issue introduced in 2.6.22 with commit 876c9d3aeb98 and fixed in 6.1.83 with commit 4d99d267da34 Issue introduced in 2.6.22 with commit 876c9d3aeb98 and fixed in 6.6.23 with commit da10f6b7918a Issue introduced in 2.6.22 with commit 876c9d3aeb98 and fixed in 6.7.11 with commit d219724d4b0d Issue introduced in 2.6.22 with commit 876c9d3aeb98 and fixed in 6.8.2 with commit 8e243ac649c1 Issue introduced in 2.6.22 with commit 876c9d3aeb98 and fixed in 6.9 with commit 5f0e4aede01c Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2024-35828 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/wireless/marvell/libertas/cmd.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/96481624fb5a6319079fb5059e46dbce43a90186 https://git.kernel.org/stable/c/bea9573c795acec5614d4ac2dcc7b3b684cea5bf https://git.kernel.org/stable/c/f0dd27314c7afe34794c2aa19dd6f2d30eb23bc7 https://git.kernel.org/stable/c/e888c4461e109f7b93c3522afcbbaa5a8fdf29d2 https://git.kernel.org/stable/c/4d99d267da3415db2124029cb5a6d2d955ca43f9 https://git.kernel.org/stable/c/da10f6b7918abd5b4bc5c9cb66f0fc6763ac48f3 https://git.kernel.org/stable/c/d219724d4b0ddb8ec7dfeaed5989f23edabaf591 https://git.kernel.org/stable/c/8e243ac649c10922a6b4855170eaefe4c5b3faab https://git.kernel.org/stable/c/5f0e4aede01cb01fa633171f0533affd25328c3a
Powered by blists - more mailing lists