i40e: Fix use-after-free in i40e_client_subtask() (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.24 % · percentile 15 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Analyzed
Description
In the Linux kernel, the following vulnerability has been resolved: i40e: Fix use-after-free in i40e_client_subtask() Currently the call to i40e_client_del_instance frees the object pf->cinst, however pf->cinst->lan_info is being accessed after the free. Fix this by adding the missing return. Addresses-Coverity: ("Read from pointer after free")
Weaknesses (CWE)
- CWE-416 — Use After Free
References
- https://git.kernel.org/stable/c/c1322eaeb8af0d8985b5cc5fa759140fa0e57b84
- https://git.kernel.org/stable/c/d718c15a2bf9ae082d5ae4d177fb19ef23cb4132
- https://git.kernel.org/stable/c/829a713450b8fb127cbabfc1244c1d8179ec5107
- https://git.kernel.org/stable/c/4ebc10aa7cd17fd9857dedac69600465c9dd16d1
- https://git.kernel.org/stable/c/1fd5d262e7442192ac7611ff1597a36c5b044323
- https://git.kernel.org/stable/c/38318f23a7ef86a8b1862e5e8078c4de121960c3
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2021-33639
- GCVE · GCVE-0-2021-46991
CERT-FR advisories
- CERTFR-2024-AVI-0363 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0265 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.16 < 4.19.191cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.20 < 5.4.120cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.5 < 5.10.38cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.11 < 5.11.22cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.12 < 5.12.5
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 7b0b1a6d0ac983ce1928432285d0222d4fb7c38b < c1322eaeb8af0d8985b5cc5fa759140fa0e57b84 ; affected 7b0b1a6d0ac983ce1928432285d0222d4fb7c38b < d718c15a2bf9ae082d5ae4d177fb19ef23cb4132 ; affected 7b0b1a6d0ac983ce1928432285d0222d4fb7c38b < 829a713450b8fb127cbabfc1244c1d8179ec5107 ; affected 7b0b1a6d0ac983ce1928432285d0222d4fb7c38b < 4ebc10aa7cd17fd9857dedac69600465c9dd16d1 ; affected 7b0b1a6d0ac983ce1928432285d0222d4fb7c38b < 1fd5d262e7442192ac7611ff1597a36c5b044323 ; affected 7b0b1a6d0ac983ce1928432285d0222d4fb7c38b < 38318f23a7ef86a8b1862e5e8078c4de121960c3 |
| Linux · Linux | affected 4.16 ; unaffected 0 < 4.16 ; unaffected 4.19.191 ≤ 4.19.* ; unaffected 5.4.120 ≤ 5.4.* ; unaffected 5.10.38 ≤ 5.10.* ; unaffected 5.11.22 ≤ 5.11.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |