CVE-2024-53213

net: usb: lan78xx: Fix double free issue with interrupt buffer allocation

High · published December 27, 2024

CVSS v3.1
7.8
EPSS
0%
Percentile
13.4
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

net: usb: lan78xx: Fix double free issue with interrupt buffer allocation

In lan78xx_probe(), the buffer `buf` was being freed twice: once

implicitly through `usb_free_urb(dev->urb_intr)` with the

`URB_FREE_BUFFER` flag and again explicitly by `kfree(buf)`. This caused

a double free issue.

To resolve this, reordered `kmalloc()` and `usb_alloc_urb()` calls to

simplify the initialization sequence and removed the redundant

`kfree(buf)`. Now, `buf` is allocated after `usb_alloc_urb()`, ensuring

it is correctly managed by `usb_fill_int_urb()` and freed by

`usb_free_urb()` as intended.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00233 · 13.4th percentile
Published
2024-12-27T13:49Z
EPSS history
Timeline
  • 27 DEC 13:49Z
    net: usb: lan78xx: Fix double free issue with interrupt buffer allocation
    cvelistv5