In the Linux kernel, the following vulnerability has been resolved: usb: vhci-hcd: Do not drop references before new references are gained At a few places the driver carries stale pointers to references that can still be used. Make sure that does not happen. This strictly speaking closes ZDI-CAN-22273, though there may be similar races in the driver.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

No data.

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/128e82e41cf7d74a562726c1587d9d2ede1a0a37 cve-icon cve-icon
https://git.kernel.org/stable/c/4dacdb9720aaab10b6be121eae55820174d97174 cve-icon cve-icon
https://git.kernel.org/stable/c/585e6bc7d0a9bf73a8be3d3fb34e86b90cc61a14 cve-icon cve-icon
https://git.kernel.org/stable/c/5a3c473b28ae1c1f7c4dc129e30cb19ae6e96f89 cve-icon cve-icon
https://git.kernel.org/stable/c/9c3746ce8d8fcb3a2405644fc0eec7fc5312de80 cve-icon cve-icon
https://git.kernel.org/stable/c/afdcfd3d6fcdeca2735ca8d994c5f2d24a368f0a cve-icon cve-icon
https://git.kernel.org/stable/c/c3d0857b7fc2c49f68f89128a5440176089a8f54 cve-icon cve-icon
https://git.kernel.org/stable/c/e8c1e606dab8c56cf074b43b98d0805de7322ba2 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2024082313-CVE-2024-43883-a594@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2024-43883 cve-icon
https://www.cve.org/CVERecord?id=CVE-2024-43883 cve-icon
History

Wed, 16 Oct 2024 02:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Low

 cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H'}

threat_severity

Moderate

Wed, 11 Sep 2024 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 27 Aug 2024 19:00:00 +0000

Type Values Removed Values Added
Metrics threat_severity

Moderate

 threat_severity

Low

Tue, 27 Aug 2024 13:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Fri, 23 Aug 2024 13:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: usb: vhci-hcd: Do not drop references before new references are gained At a few places the driver carries stale pointers to references that can still be used. Make sure that does not happen. This strictly speaking closes ZDI-CAN-22273, though there may be similar races in the driver.
Title usb: vhci-hcd: Do not drop references before new references are gained
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-08-23T13:08:10.508Z

Updated: 2024-11-05T09:41:46.542Z

Reserved: 2024-08-17T09:11:59.287Z

Link: CVE-2024-43883

cve-icon Vulnrichment

Updated: 2024-09-11T12:42:15.504Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2024-08-23T13:15:03.873

Modified: 2024-08-23T16:18:28.547

Link: CVE-2024-43883

cve-icon Redhat

Severity : Moderate

Publid Date: 2024-08-23T00:00:00Z

Links: CVE-2024-43883 - Bugzilla