In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: clear wdev->cqm_config pointer on free
When we free wdev->cqm_config when unregistering, we also need to clear out the pointer since the same wdev/netdev may get re-registered in another network namespace, then destroyed later, running this code again, which results in a double-free.
[
{
"digest": {
"length": 1334.0,
"function_hash": "96516414340272426631495081602827507840"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5fee261dfd9e17b08b1df8471ac5d5736070917",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/wireless/core.c",
"function": "_cfg80211_unregister_wdev"
},
"signature_type": "Function",
"id": "CVE-2024-50235-2179f147"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"83502587692768625553494380149534228718",
"323813798687526739055094229408653490055",
"100762884844868241040750817033600244192",
"301851430627837569435736369051310909392"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5fee261dfd9e17b08b1df8471ac5d5736070917",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/wireless/core.c"
},
"signature_type": "Line",
"id": "CVE-2024-50235-2486231b"
},
{
"digest": {
"length": 1373.0,
"function_hash": "297436280694557582289529900738111135825"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ba392e1355ba74b1d4fa11b85f71ab6ed7ecc058",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/wireless/core.c",
"function": "_cfg80211_unregister_wdev"
},
"signature_type": "Function",
"id": "CVE-2024-50235-2c153993"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"83502587692768625553494380149534228718",
"323813798687526739055094229408653490055",
"100762884844868241040750817033600244192",
"301851430627837569435736369051310909392"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6c44abb2d4c3262737d5d67832daebc8cf48b8c9",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/wireless/core.c"
},
"signature_type": "Line",
"id": "CVE-2024-50235-4ea28d83"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"83502587692768625553494380149534228718",
"323813798687526739055094229408653490055",
"100762884844868241040750817033600244192",
"301851430627837569435736369051310909392"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ba392e1355ba74b1d4fa11b85f71ab6ed7ecc058",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/wireless/core.c"
},
"signature_type": "Line",
"id": "CVE-2024-50235-87d97272"
},
{
"digest": {
"length": 1334.0,
"function_hash": "96516414340272426631495081602827507840"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6c44abb2d4c3262737d5d67832daebc8cf48b8c9",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/wireless/core.c",
"function": "_cfg80211_unregister_wdev"
},
"signature_type": "Function",
"id": "CVE-2024-50235-93079aa8"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"83502587692768625553494380149534228718",
"323813798687526739055094229408653490055",
"100762884844868241040750817033600244192",
"301851430627837569435736369051310909392"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@64e4c45d23cd7f6167f69cc2d2877bc7f54292e5",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/wireless/core.c"
},
"signature_type": "Line",
"id": "CVE-2024-50235-9eddf932"
},
{
"digest": {
"length": 1334.0,
"function_hash": "96516414340272426631495081602827507840"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@64e4c45d23cd7f6167f69cc2d2877bc7f54292e5",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/wireless/core.c",
"function": "_cfg80211_unregister_wdev"
},
"signature_type": "Function",
"id": "CVE-2024-50235-a0482546"
}
]