Junglewise Threat Intelligence

CVE-2024-35811: Linux Kernel brcmfmac UAF in brcmf_cfg80211_detach

CVE-2024-35811 · Severity: medium · CVSS 5.5 · Published 2024-05-17

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Broadcom brcmfmac Wi-Fi driver within the Linux kernel. When a USB Wi-Fi adapter using this driver is physically disconnected, a background task may continue to run and attempt to access memory that has already been cleared. This can lead to a system crash or instability, potentially allowing a local user to cause a denial-of-service.

Technical details

A use-after-free (UAF) vulnerability exists in the brcmfmac driver (specifically in the brcmf_cfg80211_detach function) due to improper synchronization with a timeout worker. When a USB device is hot-unplugged, the driver triggers a cleanup chain that frees the 'cfg' structure. However, the 'escan_timeout_work' worker, initialized during the probe phase, may still be active or scheduled. If the worker runs after the memory has been freed, it accesses the deallocated 'cfg' pointer. The fix involves ensuring the timer is deleted and the worker is synchronously canceled before the memory is freed. This is a local attack vector requiring the ability to trigger device detachment or wait for a timeout event.

Affected products

  • Linux Linux Kernel 3.7 to 4.19.312, 4.20 to 5.4.274, 5.5 to 5.10.215, 5.11 to 5.15.154, 5.16 to 6.1.84, 6.2 to 6.6.24, 6.7 to 6.7.12, 6.8 to 6.8.3

Timeline

  • 2024-05-17: advisory: Initial publication of CVE-2024-35811
  • 2024-04-03: patched: Fix committed to various stable kernel branches

References

Related threats