Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2024-26748— usb: cdns3: fix memory double free when handle zero packet

AI Predicted 5.5 Difficulty: Hard EPSS 0.24% · P16

Affected Version Matrix 16

VendorProductVersion RangeStatus
LinuxLinux7733f6c32e36ff9d7adadf40001039bf219b1cbe< aad6132ae6e4809e375431f8defd1521985e44e7affected
7733f6c32e36ff9d7adadf40001039bf219b1cbe< 1e204a8e9eb514e22a6567fb340ebb47df3f3a48affected
7733f6c32e36ff9d7adadf40001039bf219b1cbe< 3a2a909942b5335b7ea66366d84261b3ed5f89c8affected
7733f6c32e36ff9d7adadf40001039bf219b1cbe< 9a52b694b066f299d8b9800854a8503457a8b64caffected
7733f6c32e36ff9d7adadf40001039bf219b1cbe< 70e8038813f9d3e72df966748ebbc40efe466019affected
7733f6c32e36ff9d7adadf40001039bf219b1cbe< 92d20406a3d4ff3e8be667c79209dc9ed31df5b3affected
7733f6c32e36ff9d7adadf40001039bf219b1cbe< 5fd9e45f1ebcd57181358af28506e8a661a260b3affected
5.4affected
… +8 more rows
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2024-26748

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
usb: cdns3: fix memory double free when handle zero packet
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix memory double free when handle zero packet 829 if (request->complete) { 830 spin_unlock(&priv_dev->lock); 831 usb_gadget_giveback_request(&priv_ep->endpoint, 832 request); 833 spin_lock(&priv_dev->lock); 834 } 835 836 if (request->buf == priv_dev->zlp_buf) 837 cdns3_gadget_ep_free_request(&priv_ep->endpoint, request); Driver append an additional zero packet request when queue a packet, which length mod max packet size is 0. When transfer complete, run to line 831, usb_gadget_giveback_request() will free this requestion. 836 condition is true, so cdns3_gadget_ep_free_request() free this request again. Log: [ 1920.140696][ T150] BUG: KFENCE: use-after-free read in cdns3_gadget_giveback+0x134/0x2c0 [cdns3] [ 1920.140696][ T150] [ 1920.151837][ T150] Use-after-free read at 0x000000003d1cd10b (in kfence-#36): [ 1920.159082][ T150] cdns3_gadget_giveback+0x134/0x2c0 [cdns3] [ 1920.164988][ T150] cdns3_transfer_completed+0x438/0x5f8 [cdns3] Add check at line 829, skip call usb_gadget_giveback_request() if it is additional zero length packet request. Needn't call usb_gadget_giveback_request() because it is allocated in this driver.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于内存双重释放。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
LinuxLinux 7733f6c32e36ff9d7adadf40001039bf219b1cbe ~ aad6132ae6e4809e375431f8defd1521985e44e7 -
LinuxLinux 5.4 -

II. Public POCs for CVE-2024-26748

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-26748

请登录查看更多情报信息。

Mailing List Discussions for CVE-2024-26748 (1)

Other References for CVE-2024-26748 (5)

Same Patch Batch · Linux · 2024-04-03 · 94 CVEs total

CVE-2024-26743RDMA/qedr: Fix qedr_create_user_qp error flow
CVE-2024-26740net/sched: act_mirred: use the backlog for mirred ingress
CVE-2024-26738powerpc/pseries/iommu: DLPAR add doesn't completely initialize pci_controller
CVE-2024-26734devlink: fix possible use-after-free and memory leaks in devlink_init()
CVE-2024-26733arp: Prevent overflow in arp_req_get().
CVE-2024-26732net: implement lockless setsockopt(SO_PEEK_OFF)
CVE-2024-26731bpf, sockmap: Fix NULL pointer dereference in sk_psock_verdict_data_ready()
CVE-2024-26730hwmon: (nct6775) Fix access to temperature configuration registers
CVE-2024-26735ipv6: sr: fix possible use-after-free and null-ptr-deref
CVE-2024-26742scsi: smartpqi: Fix disable_managed_interrupts
CVE-2024-26741dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished().
CVE-2024-26744RDMA/srpt: Support specifying the srpt_service_guid parameter
CVE-2024-26747usb: roles: fix NULL pointer issue when put module's reference
CVE-2024-26749usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable()
CVE-2024-26751ARM: ep93xx: Add terminator to gpiod_lookup_table
CVE-2024-26752l2tp: pass correct message length to ip6_append_data
CVE-2024-26753crypto: virtio/akcipher - Fix stack overflow on memcpy
CVE-2024-26754gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()
CVE-2024-26755md: Don't suspend the array for interrupted reshape
CVE-2024-26756md: Don't register sync_thread for reshape directly

Showing top 20 of 94 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2024-26748

No comments yet

Leave a comment