| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2025011122-CVE-2024-52332-9d2f@gregkh> Date: Sat, 11 Jan 2025 13:25:30 +0100 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org> Subject: CVE-2024-52332: igb: Fix potential invalid memory access in igb_init_module() Description =========== In the Linux kernel, the following vulnerability has been resolved: igb: Fix potential invalid memory access in igb_init_module() The pci_register_driver() can fail and when this happened, the dca_notifier needs to be unregistered, otherwise the dca_notifier can be called when igb fails to install, resulting to invalid memory access. The Linux kernel CVE team has assigned CVE-2024-52332 to this issue. Affected and fixed versions =========================== Issue introduced in 2.6.29 with commit bbd98fe48a43464b4a044bc4cbeefad284d6aa80 and fixed in 5.4.287 with commit 4458046617dfadc351162dbaea1945c57eebdf36 Issue introduced in 2.6.29 with commit bbd98fe48a43464b4a044bc4cbeefad284d6aa80 and fixed in 5.10.231 with commit e0155b1b1509d0ef4799bd1cd73309ca466df3f3 Issue introduced in 2.6.29 with commit bbd98fe48a43464b4a044bc4cbeefad284d6aa80 and fixed in 5.15.174 with commit 4fe517643f529e805bb6b890a4331c100e8f2484 Issue introduced in 2.6.29 with commit bbd98fe48a43464b4a044bc4cbeefad284d6aa80 and fixed in 6.1.120 with commit 8009cdcc493fa30d4572016daf2d6999da4d6c54 Issue introduced in 2.6.29 with commit bbd98fe48a43464b4a044bc4cbeefad284d6aa80 and fixed in 6.6.66 with commit f309733a8c9da7d4266a8a3755020b738a570cae Issue introduced in 2.6.29 with commit bbd98fe48a43464b4a044bc4cbeefad284d6aa80 and fixed in 6.12.5 with commit 992fd34122de377b45cb75b64fc7f17fc1e6ed2f Issue introduced in 2.6.29 with commit bbd98fe48a43464b4a044bc4cbeefad284d6aa80 and fixed in 6.13-rc2 with commit 0566f83d206c7a864abcd741fe39d6e0ae5eef29 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2024-52332 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/ethernet/intel/igb/igb_main.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/4458046617dfadc351162dbaea1945c57eebdf36 https://git.kernel.org/stable/c/e0155b1b1509d0ef4799bd1cd73309ca466df3f3 https://git.kernel.org/stable/c/4fe517643f529e805bb6b890a4331c100e8f2484 https://git.kernel.org/stable/c/8009cdcc493fa30d4572016daf2d6999da4d6c54 https://git.kernel.org/stable/c/f309733a8c9da7d4266a8a3755020b738a570cae https://git.kernel.org/stable/c/992fd34122de377b45cb75b64fc7f17fc1e6ed2f https://git.kernel.org/stable/c/0566f83d206c7a864abcd741fe39d6e0ae5eef29
Powered by blists - more mailing lists