In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: clear wdev->cqm_config pointer on free
When we free wdev->cqm_config when unregistering, we also need to clear out the pointer since the same wdev/netdev may get re-registered in another network namespace, then destroyed later, running this code again, which results in a double-free.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50235.json"
}"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-50235.json"
[
{
"signature_type": "Function",
"id": "CVE-2024-50235-2179f147",
"target": {
"function": "_cfg80211_unregister_wdev",
"file": "net/wireless/core.c"
},
"digest": {
"length": 1334.0,
"function_hash": "96516414340272426631495081602827507840"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5fee261dfd9e17b08b1df8471ac5d5736070917"
},
{
"signature_type": "Line",
"id": "CVE-2024-50235-2486231b",
"target": {
"file": "net/wireless/core.c"
},
"digest": {
"line_hashes": [
"83502587692768625553494380149534228718",
"323813798687526739055094229408653490055",
"100762884844868241040750817033600244192",
"301851430627837569435736369051310909392"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5fee261dfd9e17b08b1df8471ac5d5736070917"
},
{
"signature_type": "Line",
"id": "CVE-2024-50235-9eddf932",
"target": {
"file": "net/wireless/core.c"
},
"digest": {
"line_hashes": [
"83502587692768625553494380149534228718",
"323813798687526739055094229408653490055",
"100762884844868241040750817033600244192",
"301851430627837569435736369051310909392"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@64e4c45d23cd7f6167f69cc2d2877bc7f54292e5"
},
{
"signature_type": "Function",
"id": "CVE-2024-50235-a0482546",
"target": {
"function": "_cfg80211_unregister_wdev",
"file": "net/wireless/core.c"
},
"digest": {
"length": 1334.0,
"function_hash": "96516414340272426631495081602827507840"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@64e4c45d23cd7f6167f69cc2d2877bc7f54292e5"
}
]