In the Linux kernel, the following vulnerability has been resolved:
wifi: brcmfmac: pcie: handle randbuf allocation failure
The kzalloc() in brcmfpciedownloadfwnvram() will return null if the physical memory has run out. As a result, if we use getrandombytes() to generate random bytes in the randbuf, the null pointer dereference bug will happen.
In order to prevent allocation failure, this patch adds a separate function using buffer on kernel stack to generate random bytes in the randbuf, which could prevent the kernel stack from overflow.
[
{
"digest": {
"function_hash": "201187371315052955256155968074009452343",
"length": 2079.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0eb2c0528e232b3c32cde9d5e1c9f80ba2996e49",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2024-38575-08bd55df",
"target": {
"function": "brcmf_pcie_download_fw_nvram",
"file": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c"
}
},
{
"digest": {
"function_hash": "201187371315052955256155968074009452343",
"length": 2079.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@316f790ebcf94bdf59f794b7cdea4068dc676d4c",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2024-38575-28e4d8ff",
"target": {
"function": "brcmf_pcie_download_fw_nvram",
"file": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"66399885064308115605847976196079485899",
"31699376461171318614422929777568069253",
"257329427810662233097154844237415133532",
"137281033929369899917761038803016618551",
"163570798619433896923491338925315242990",
"323123044876675425157111551185558157272",
"176941590700249743942470030484149881738",
"292718263008932928506465356316972152346",
"259400374972460563970843915475181699801",
"42923682894485114915851502744237958582",
"282825697047322093942891126730740463018",
"87951612598560856191054730114106840061",
"9643295393591693522306273556317572503",
"301180794796153424007815969820481870190"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0eb2c0528e232b3c32cde9d5e1c9f80ba2996e49",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2024-38575-4af54241",
"target": {
"file": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"66399885064308115605847976196079485899",
"31699376461171318614422929777568069253",
"257329427810662233097154844237415133532",
"137281033929369899917761038803016618551",
"163570798619433896923491338925315242990",
"323123044876675425157111551185558157272",
"176941590700249743942470030484149881738",
"292718263008932928506465356316972152346",
"259400374972460563970843915475181699801",
"42923682894485114915851502744237958582",
"282825697047322093942891126730740463018",
"87951612598560856191054730114106840061",
"9643295393591693522306273556317572503",
"301180794796153424007815969820481870190"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3729ca9e48d19a03ae049e2bde510e161c2f3720",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2024-38575-5583116c",
"target": {
"file": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"66399885064308115605847976196079485899",
"31699376461171318614422929777568069253",
"257329427810662233097154844237415133532",
"137281033929369899917761038803016618551",
"163570798619433896923491338925315242990",
"323123044876675425157111551185558157272",
"176941590700249743942470030484149881738",
"292718263008932928506465356316972152346",
"259400374972460563970843915475181699801",
"42923682894485114915851502744237958582",
"282825697047322093942891126730740463018",
"87951612598560856191054730114106840061",
"9643295393591693522306273556317572503",
"301180794796153424007815969820481870190"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7c15eb344b0d4d3468c9b2a7591ad2b859b29b88",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2024-38575-743d2e6c",
"target": {
"file": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"66399885064308115605847976196079485899",
"31699376461171318614422929777568069253",
"257329427810662233097154844237415133532",
"137281033929369899917761038803016618551",
"163570798619433896923491338925315242990",
"323123044876675425157111551185558157272",
"176941590700249743942470030484149881738",
"292718263008932928506465356316972152346",
"259400374972460563970843915475181699801",
"42923682894485114915851502744237958582",
"282825697047322093942891126730740463018",
"87951612598560856191054730114106840061",
"9643295393591693522306273556317572503",
"301180794796153424007815969820481870190"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@316f790ebcf94bdf59f794b7cdea4068dc676d4c",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2024-38575-998335b4",
"target": {
"file": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c"
}
},
{
"digest": {
"function_hash": "201187371315052955256155968074009452343",
"length": 2079.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7c15eb344b0d4d3468c9b2a7591ad2b859b29b88",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2024-38575-c93b2a07",
"target": {
"function": "brcmf_pcie_download_fw_nvram",
"file": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"66399885064308115605847976196079485899",
"31699376461171318614422929777568069253",
"257329427810662233097154844237415133532",
"137281033929369899917761038803016618551",
"163570798619433896923491338925315242990",
"323123044876675425157111551185558157272",
"176941590700249743942470030484149881738",
"292718263008932928506465356316972152346",
"259400374972460563970843915475181699801",
"42923682894485114915851502744237958582",
"282825697047322093942891126730740463018",
"87951612598560856191054730114106840061",
"9643295393591693522306273556317572503",
"301180794796153424007815969820481870190"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c37466406f075476c2702ecc01917928af871f3b",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2024-38575-e03a18ac",
"target": {
"file": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c"
}
},
{
"digest": {
"function_hash": "201187371315052955256155968074009452343",
"length": 2079.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c37466406f075476c2702ecc01917928af871f3b",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2024-38575-f441f0a4",
"target": {
"function": "brcmf_pcie_download_fw_nvram",
"file": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c"
}
},
{
"digest": {
"function_hash": "201187371315052955256155968074009452343",
"length": 2079.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3729ca9e48d19a03ae049e2bde510e161c2f3720",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2024-38575-f8754279",
"target": {
"function": "brcmf_pcie_download_fw_nvram",
"file": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c"
}
}
]