Linux Kernel up to 6.8.2/6.9-rc1 typec tcpm_port_unregister_pd double free

Summaryinfo

A vulnerability was found in Linux Kernel up to 6.8.2/6.9-rc1. It has been rated as problematic. Affected by this vulnerability is the function tcpm_port_unregister_pd of the component typec. Performing a manipulation results in double free. This vulnerability is reported as CVE-2024-26932. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic has been found in Linux Kernel up to 6.8.2/6.9-rc1. This affects the function tcpm_port_unregister_pd of the component typec. The manipulation with an unknown input leads to a double free vulnerability. CWE is classifying the issue as CWE-415. The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations. The impact remains unknown. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: fix double-free issue in tcpm_port_unregister_pd() When unregister pd capabilitie in tcpm, KASAN will capture below double -free issue. The root cause is the same capabilitiy will be kfreed twice, the first time is kfreed by pd_capabilities_release() and the second time is explicitly kfreed by tcpm_port_unregister_pd(). [ 3.988059] BUG: KASAN: double-free in tcpm_port_unregister_pd+0x1a4/0x3dc [ 3.995001] Free of addr ffff0008164d3000 by task kworker/u16:0/10 [ 4.001206] [ 4.002712] CPU: 2 PID: 10 Comm: kworker/u16:0 Not tainted 6.8.0-rc5-next-20240220-05616-g52728c567a55 #53 [ 4.012402] Hardware name: Freescale i.MX8QXP MEK (DT) [ 4.017569] Workqueue: events_unbound deferred_probe_work_func [ 4.023456] Call trace: [ 4.025920] dump_backtrace+0x94/0xec [ 4.029629] show_stack+0x18/0x24 [ 4.032974] dump_stack_lvl+0x78/0x90 [ 4.036675] print_report+0xfc/0x5c0 [ 4.040289] kasan_report_invalid_free+0xa0/0xc0 [ 4.044937] __kasan_slab_free+0x124/0x154 [ 4.049072] kfree+0xb4/0x1e8 [ 4.052069] tcpm_port_unregister_pd+0x1a4/0x3dc [ 4.056725] tcpm_register_port+0x1dd0/0x2558 [ 4.061121] tcpci_register_port+0x420/0x71c [ 4.065430] tcpci_probe+0x118/0x2e0 To fix the issue, this will remove kree() from tcpm_port_unregister_pd().

It is possible to read the advisory at git.kernel.org. This vulnerability is uniquely identified as CVE-2024-26932 since 02/19/2024. The exploitability is told to be difficult. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 247423 (Linux Distros Unpatched Vulnerability : CVE-2024-26932), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.8.3 or 6.9-rc2 eliminates this vulnerability. Applying the patch 242e425ed580/b63f90487bdf is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (247423) and CERT Bund (WID-SEC-2024-1008). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• Oracle VM
• EMC Avamar
• IBM QRadar SIEM
• Dell NetWorker
• IBM Security Guardium
• RESF Rocky Linux
• Broadcom Brocade SANnav
• Open Source Linux Kernel
• IBM Business Automation Workflow
• IBM Spectrum Protect Plus
• Dell Avamar
• Juniper Junos Space
• IBM DataPower Gateway
• IBM Storage Scale System
• SolarWinds Security Event Manager
• Dell PowerProtect Data Domain
• Dell PowerScale OneFS

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.8.0
• 6.8.1
• 6.8.2
• 6.9-rc1

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion