CVE-2024-38628CWE-362

CVE-2024-38628

High · published June 21, 2024

CVSS v3.1
7.8
EPSS
0%
Percentile
7.3
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind.

Hang on to the control IDs instead of pointers since those are correctly

handled with locks.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00181 · 7.3th percentile
Weakness
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Published
2024-06-21T15:15Z
Affected products (3)
ProductVersionsFixed in
linux/linux_kernel≥ 5.15, < 6.1.936.1.93
linux/linux_kernel≥ 6.2, < 6.6.336.6.33
linux/linux_kernel≥ 6.7, < 6.9.46.9.4
References (8)
https://git.kernel.org/stable/c/1b739388aa3f8dfb63a9fca777e6dfa6912d0464 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/453d3fa9266e53f85377b911c19b9a4563fa88c0 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/89e66809684485590ea0b32c3178e42cba36ac09 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/bea73b58ab67fe581037ad9cdb93c2557590c068 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/1b739388aa3f8dfb63a9fca777e6dfa6912d0464 · af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/453d3fa9266e53f85377b911c19b9a4563fa88c0 · af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/89e66809684485590ea0b32c3178e42cba36ac09 · af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/bea73b58ab67fe581037ad9cdb93c2557590c068 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 21 JUN 10:18Z
    usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind.
    cvelistv5