{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-43830", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-08-17T09:11:59.273Z", "datePublished": "2024-08-17T09:21:48.946Z", "dateUpdated": "2026-08-05T11:36:40.589Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:36:40.589Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nleds: trigger: Unregister sysfs attributes before calling deactivate()\n\nTriggers which have trigger specific sysfs attributes typically store\nrelated data in trigger-data allocated by the activate() callback and\nfreed by the deactivate() callback.\n\nCalling device_remove_groups() after calling deactivate() leaves a window\nwhere the sysfs attributes show/store functions could be called after\ndeactivation and then operate on the just freed trigger-data.\n\nMove the device_remove_groups() call to before deactivate() to close\nthis race window.\n\nThis also makes the deactivation path properly do things in reverse order\nof the activation path which calls the activate() callback before calling\ndevice_add_groups()." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerability is reached only through local interfaces — sysfs writes/reads under /sys/class/leds// and the v4l2 subdev/flash device nodes that call led_trigger_remove(). No network, adjacent-network, or physical-attach path reaches led_trigger_set().\nAC:L - The attacker drives both sides of the race from two of their own threads, and the window is not instruction-tight: ttyname_store()/ttyname_show() sleep for up to hundreds of milliseconds inside wait_for_completion_timeout() on the trigger data while the concurrent trigger change calls deactivate() and frees it, with no lock or kernfs drain in between. Attempts are unlimited and free, so the UAF can be hit reliably.\nPR:L - The racing sysfs attribute show/store callbacks that touch the freed trigger data are world-readable (0644), and the deactivation side is reachable by an unprivileged local user through v4l2_flash_open()/privacy-LED handling on a camera subdev node, or on Android/embedded systems where /sys/class/leds/*/trigger is chowned to a non-root service UID. No real root in the init namespace is required.\nUI:N - The attacker performs both the trigger change and the concurrent attribute access from their own threads; no victim action or interaction is needed.\nS:U - The use-after-free corrupts kernel slab memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The show callbacks read the freed trigger_data — e.g. ttyname_show() sprintf()s a dangling char * to a user buffer and netdev's device_name_show()/interval_show() copy out freed-slab contents — giving a groomable kernel heap information leak.\nI:H - Store callbacks write into the freed object (reinit_completion(), trigger_data->ttyname = ..., atomic_set of interval, mode bit sets) and then act on attacker-groomable pointers via kfree(trigger_data->ttyname), tty_kref_put(trigger_data->tty), and schedule_delayed_work() on a freed delayed_work — arbitrary free, refcount decrement, and work-function-pointer control suitable for privilege escalation.\nA:H - Operating on freed trigger data corrupts the slab, the workqueue/timer lists, and the completion wait queue, reliably producing a kernel oops or panic that the attacker can trigger repeatedly." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/leds/led-triggers.c" ], "versions": [ { "version": "a7e7a3156300a7e1982b03cc9cb8fb0c86434c49", "lessThan": "c3b7a650c8717aa89df318364609c86cbc040156", "status": "affected", "versionType": "git" }, { "version": "a7e7a3156300a7e1982b03cc9cb8fb0c86434c49", "lessThan": "d1415125b701ef13370e2761f691ec632a5eb93a", "status": "affected", "versionType": "git" }, { "version": "a7e7a3156300a7e1982b03cc9cb8fb0c86434c49", "lessThan": "09c1583f0e10c918855d6e7540a79461a353e5d6", "status": "affected", "versionType": "git" }, { "version": "a7e7a3156300a7e1982b03cc9cb8fb0c86434c49", "lessThan": "3fb6a9d67cfd812a547ac73ec02e1077c26c640d", "status": "affected", "versionType": "git" }, { "version": "a7e7a3156300a7e1982b03cc9cb8fb0c86434c49", "lessThan": "734ba6437e80dfc780e9ee9d95f912392d12b5ea", "status": "affected", "versionType": "git" }, { "version": "a7e7a3156300a7e1982b03cc9cb8fb0c86434c49", "lessThan": "cb8aa9d2a4c8a15d6a43ccf901ef3d094aa60374", "status": "affected", "versionType": "git" }, { "version": "a7e7a3156300a7e1982b03cc9cb8fb0c86434c49", "lessThan": "0788a6f3523d3686a9eed5ea1e6fcce6841277b2", "status": "affected", "versionType": "git" }, { "version": "a7e7a3156300a7e1982b03cc9cb8fb0c86434c49", "lessThan": "c0dc9adf9474ecb7106e60e5472577375aedaed3", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/leds/led-triggers.c" ], "versions": [ { "version": "4.19", "status": "affected" }, { "version": "0", "lessThan": "4.19", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.320", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.282", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.224", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.165", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.103", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.44", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.3", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "4.19.320" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.4.282" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.10.224" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.15.165" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.1.103" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.6.44" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.10.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.11" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/c3b7a650c8717aa89df318364609c86cbc040156" }, { "url": "https://git.kernel.org/stable/c/d1415125b701ef13370e2761f691ec632a5eb93a" }, { "url": "https://git.kernel.org/stable/c/09c1583f0e10c918855d6e7540a79461a353e5d6" }, { "url": "https://git.kernel.org/stable/c/3fb6a9d67cfd812a547ac73ec02e1077c26c640d" }, { "url": "https://git.kernel.org/stable/c/734ba6437e80dfc780e9ee9d95f912392d12b5ea" }, { "url": "https://git.kernel.org/stable/c/cb8aa9d2a4c8a15d6a43ccf901ef3d094aa60374" }, { "url": "https://git.kernel.org/stable/c/0788a6f3523d3686a9eed5ea1e6fcce6841277b2" }, { "url": "https://git.kernel.org/stable/c/c0dc9adf9474ecb7106e60e5472577375aedaed3" } ], "title": "leds: trigger: Unregister sysfs attributes before calling deactivate()", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-43830", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T16:08:31.513833Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-12T17:33:23.792Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:05:15.405Z" } }, { "x_adpType": "supplier", "providerMetadata": { "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-05-12T11:56:56.293Z" }, "affected": [ { "vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [ { "status": "affected", "version": "0", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" } ], "references": [ { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ] } ] } }