CVE-2024-38628 - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind. Hang on to the control IDs instead of pointers since those are correctly handled with locks.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/1b739388aa3f8dfb63a9fca777e6dfa6912d0464
https://git.kernel.org/stable/c/453d3fa9266e53f85377b911c19b9a4563fa88c0
https://git.kernel.org/stable/c/89e66809684485590ea0b32c3178e42cba36ac09
https://git.kernel.org/stable/c/bea73b58ab67fe581037ad9cdb93c2557590c068
https://lore.kernel.org/linux-cve-announce/2024062140-CVE-2024-38628-e2db@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2024-38628
https://www.cve.org/CVERecord?id=CVE-2024-38628

History

No history.

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-06-21T10:18:19.558Z

Updated: 2024-08-02T04:12:26.065Z

Reserved: 2024-06-18T19:36:34.946Z

Link: CVE-2024-38628

Vulnrichment

Updated: 2024-06-24T15:20:28.195Z

NVD

Status : Awaiting Analysis

Published: 2024-06-21T11:15:11.660

Modified: 2024-06-21T11:22:01.687

Link: CVE-2024-38628

Redhat

Severity : Low

Publid Date: 2024-06-21T00:00:00Z

Links: CVE-2024-38628 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-38628", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-06-18T19:36:34.946Z", "datePublished": "2024-06-21T10:18:19.558Z", "dateUpdated": "2024-08-02T04:12:26.065Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-07-15T06:49:22.881Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind.\n\nHang on to the control IDs instead of pointers since those are correctly\nhandled with locks."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/gadget/function/u_audio.c"], "versions": [{"version": "02de698ca812", "lessThan": "89e668096844", "status": "affected", "versionType": "git"}, {"version": "02de698ca812", "lessThan": "453d3fa9266e", "status": "affected", "versionType": "git"}, {"version": "02de698ca812", "lessThan": "bea73b58ab67", "status": "affected", "versionType": "git"}, {"version": "02de698ca812", "lessThan": "1b739388aa3f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/gadget/function/u_audio.c"], "versions": [{"version": "5.15", "status": "affected"}, {"version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "custom"}, {"version": "6.1.93", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "custom"}, {"version": "6.6.33", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "custom"}, {"version": "6.9.4", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "custom"}, {"version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/89e66809684485590ea0b32c3178e42cba36ac09"}, {"url": "https://git.kernel.org/stable/c/453d3fa9266e53f85377b911c19b9a4563fa88c0"}, {"url": "https://git.kernel.org/stable/c/bea73b58ab67fe581037ad9cdb93c2557590c068"}, {"url": "https://git.kernel.org/stable/c/1b739388aa3f8dfb63a9fca777e6dfa6912d0464"}], "title": "usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind.", "x_generator": {"engine": "bippy-c9c4e1df01b2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-24T15:20:09.528911Z", "id": "CVE-2024-38628", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-24T15:20:30.852Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:12:26.065Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/89e66809684485590ea0b32c3178e42cba36ac09", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/453d3fa9266e53f85377b911c19b9a4563fa88c0", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/bea73b58ab67fe581037ad9cdb93c2557590c068", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1b739388aa3f8dfb63a9fca777e6dfa6912d0464", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-38628", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-24T15:20:09.528911Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-24T15:20:28.195Z"}}], "cna": {"title": "usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind.", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "02de698ca812", "lessThan": "89e668096844", "versionType": "git"}, {"status": "affected", "version": "02de698ca812", "lessThan": "453d3fa9266e", "versionType": "git"}, {"status": "affected", "version": "02de698ca812", "lessThan": "bea73b58ab67", "versionType": "git"}, {"status": "affected", "version": "02de698ca812", "lessThan": "1b739388aa3f", "versionType": "git"}], "programFiles": ["drivers/usb/gadget/function/u_audio.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.15"}, {"status": "unaffected", "version": "0", "lessThan": "5.15", "versionType": "custom"}, {"status": "unaffected", "version": "6.1.93", "versionType": "custom", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.33", "versionType": "custom", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.9.4", "versionType": "custom", "lessThanOrEqual": "6.9.*"}, {"status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/usb/gadget/function/u_audio.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/89e66809684485590ea0b32c3178e42cba36ac09"}, {"url": "https://git.kernel.org/stable/c/453d3fa9266e53f85377b911c19b9a4563fa88c0"}, {"url": "https://git.kernel.org/stable/c/bea73b58ab67fe581037ad9cdb93c2557590c068"}, {"url": "https://git.kernel.org/stable/c/1b739388aa3f8dfb63a9fca777e6dfa6912d0464"}], "x_generator": {"engine": "bippy-c9c4e1df01b2"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind.\n\nHang on to the control IDs instead of pointers since those are correctly\nhandled with locks."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-07-15T06:49:22.881Z"}}}, "cveMetadata": {"cveId": "CVE-2024-38628", "state": "PUBLISHED", "dateUpdated": "2024-07-15T06:49:22.881Z", "dateReserved": "2024-06-18T19:36:34.946Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-06-21T10:18:19.558Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}