{ "dataType": "CVE_RECORD", "cveMetadata": { "cveId": "CVE-2024-35811", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-17T12:19:12.342Z", "datePublished": "2024-05-17T13:23:17.508Z", "dateUpdated": "2026-08-05T11:30:05.862Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:30:05.862Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach\n\nThis is the candidate patch of CVE-2023-47233 :\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-47233\n\nIn brcm80211 driver,it starts with the following invoking chain\nto start init a timeout worker:\n\n->brcmf_usb_probe\n ->brcmf_usb_probe_cb\n ->brcmf_attach\n ->brcmf_bus_started\n ->brcmf_cfg80211_attach\n ->wl_init_priv\n ->brcmf_init_escan\n ->INIT_WORK(&cfg->escan_timeout_work,\n\t\t brcmf_cfg80211_escan_timeout_worker);\n\nIf we disconnect the USB by hotplug, it will call\nbrcmf_usb_disconnect to make cleanup. The invoking chain is :\n\nbrcmf_usb_disconnect\n ->brcmf_usb_disconnect_cb\n ->brcmf_detach\n ->brcmf_cfg80211_detach\n ->kfree(cfg);\n\nWhile the timeout woker may still be running. This will cause\na use-after-free bug on cfg in brcmf_cfg80211_escan_timeout_worker.\n\nFix it by deleting the timer and canceling the worker in\nbrcmf_cfg80211_detach.\n\n[arend.vanspriel@broadcom.com: keep timer delete as is and cancel work just before free]" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:A - The vulnerable free/use race is in a WiFi driver and is reached automatically via the firmware-crash recovery path (`brcmf_fw_crashed()` → `bus_reset` work → `brcmf_pcie_reset`/`brcmf_sdio_bus_reset` → `brcmf_detach` → `brcmf_cfg80211_detach` → `kfree(cfg)`), while the escan timeout worker fires precisely because the firmware stopped responding mid-scan. An adjacent 802.11 attacker who induces a firmware halt (a well-documented failure mode of Broadcom fullmac firmware when fed malformed frames) while the station is doing its routine background scanning triggers both sides of the race over the air.\nAC:L - The attacker controls both halves of the race — the stalled scan that guarantees the 10 s escan timer expires and the firmware halt that drives the detach — and the window is wide because the worker blocks in `brcmf_fil_cmd_data_set()` waiting on a dead firmware while `brcmf_cfg80211_detach()` frees `escan_buf` and `cfg` in parallel. The attempt is freely repeatable, and heap grooming of the freed 65000-byte buffer and `cfg` slab is standard.\nPR:N - No local account or capability is needed on the affected system: the scan is issued by the normal background supplicant/NetworkManager activity, and the detach is performed autonomously by the driver's bus-reset recovery worker in response to a firmware halt. The originally reported USB-hotplug variant likewise requires no privileges.\nUI:N - Background scanning by wpa_supplicant/NetworkManager is continuous and automatic, and the `brcmf_fw_crashed()` → bus-reset → detach sequence runs entirely inside the kernel without any user action. No victim interaction is required at any point.\nS:U - The use-after-free corrupts kernel heap objects and is exploited within the kernel's own security authority, with no crossing of a hypervisor, IOMMU, or sandbox boundary. Impact remains confined to the kernel that owns the vulnerable component.\nC:H - After the free, `brcmf_inform_bss()` walks the dangling `escan_info.escan_buf` with a length/count taken from reallocated memory, giving controlled out-of-bounds reads, and `brcmf_inform_single_bss()` hands the resulting `notify_ie`/`notify_ielen` to `cfg80211_inform_bss_data()`, which copies that kernel memory into a BSS entry retrievable by userspace via nl80211. This is an arbitrary kernel-memory read with a direct exfiltration channel.\nI:H - The worker performs an indirect call through `cfg->d11inf.decchspec`, a function pointer loaded from the freed `cfg` object, giving control-flow hijack once the slab is reallocated with attacker-controlled data, and it also writes into freed memory (`bi->ctl_ch`, `cfg->scan_request = NULL`, `timer_delete_sync()` on a freed `timer_list`). Combined with the stale `ifp` and `scan_request` passed into further kernel calls, this yields write and code-execution primitives.\nA:H - Even without full exploitation, dereferencing the freed `cfg`, freed `escan_buf`, and freed `brcmf_if`, and running `timer_delete_sync()`/`cfg80211_scan_done()` on freed structures, reliably produces oopses, slab corruption, and kernel panic. The WiFi interface is destroyed and the system crashes." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c" ], "versions": [ { "version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62", "lessThan": "202c503935042272e2f9e1bb549d5f69a8681169", "status": "affected", "versionType": "git" }, { "version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62", "lessThan": "8e3f03f4ef7c36091f46e7349096efb5a2cdb3a1", "status": "affected", "versionType": "git" }, { "version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62", "lessThan": "bacb8c3ab86dcd760c15903fcee58169bc3026aa", "status": "affected", "versionType": "git" }, { "version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62", "lessThan": "8c36205123dc57349b59b4f1a2301eb278cbc731", "status": "affected", "versionType": "git" }, { "version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62", "lessThan": "0b812f706fd7090be74812101114a0e165b36744", "status": "affected", "versionType": "git" }, { "version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62", "lessThan": "190794848e2b9d15de92d502b6ac652806904f5a", "status": "affected", "versionType": "git" }, { "version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62", "lessThan": "6678a1e7d896c00030b31491690e8ddc9a90767a", "status": "affected", "versionType": "git" }, { "version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62", "lessThan": "0a7591e14a8da794d0b93b5d1c6254ccb23adacb", "status": "affected", "versionType": "git" }, { "version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62", "lessThan": "0f7352557a35ab7888bc7831411ec8a3cbe20d78", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c" ], "versions": [ { "version": "3.7", "status": "affected" }, { "version": "0", "lessThan": "3.7", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.312", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.274", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.215", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.154", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.84", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.24", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.7.12", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.8.3", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "4.19.312" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "5.4.274" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "5.10.215" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "5.15.154" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.1.84" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.6.24" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.7.12" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.8.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.9" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/202c503935042272e2f9e1bb549d5f69a8681169" }, { "url": "https://git.kernel.org/stable/c/8e3f03f4ef7c36091f46e7349096efb5a2cdb3a1" }, { "url": "https://git.kernel.org/stable/c/bacb8c3ab86dcd760c15903fcee58169bc3026aa" }, { "url": "https://git.kernel.org/stable/c/8c36205123dc57349b59b4f1a2301eb278cbc731" }, { "url": "https://git.kernel.org/stable/c/0b812f706fd7090be74812101114a0e165b36744" }, { "url": "https://git.kernel.org/stable/c/190794848e2b9d15de92d502b6ac652806904f5a" }, { "url": "https://git.kernel.org/stable/c/6678a1e7d896c00030b31491690e8ddc9a90767a" }, { "url": "https://git.kernel.org/stable/c/0a7591e14a8da794d0b93b5d1c6254ccb23adacb" }, { "url": "https://git.kernel.org/stable/c/0f7352557a35ab7888bc7831411ec8a3cbe20d78" } ], "title": "wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:21:47.516Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/202c503935042272e2f9e1bb549d5f69a8681169", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/8e3f03f4ef7c36091f46e7349096efb5a2cdb3a1", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/bacb8c3ab86dcd760c15903fcee58169bc3026aa", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/8c36205123dc57349b59b4f1a2301eb278cbc731", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/0b812f706fd7090be74812101114a0e165b36744", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/190794848e2b9d15de92d502b6ac652806904f5a", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/6678a1e7d896c00030b31491690e8ddc9a90767a", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/0a7591e14a8da794d0b93b5d1c6254ccb23adacb", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/0f7352557a35ab7888bc7831411ec8a3cbe20d78", "tags": [ "x_transferred" ] }, { "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": [ "x_transferred" ] }, { "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html", "tags": [ "x_transferred" ] } ] }, { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-35811", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T15:42:35.275433Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:32:51.552Z" } }, { "x_adpType": "supplier", "providerMetadata": { "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-05-12T11:52:09.242Z" }, "affected": [ { "vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [ { "status": "affected", "version": "0", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" } ], "references": [ { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ] } ] }, "dataVersion": "5.2" }