目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CVE-2024-35852— Linux kernel 安全漏洞

一分钟漏洞结论

影响对象
Linux Linux
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于内存泄漏。

AI 预测 3.3 利用难度: 困难 EPSS 0.26% · P17

可能的 ATT&CK 技术 1 AI

T1496 · Resource Hijacking

影响版本矩阵 16

厂商产品 版本范围状态
Linux Linux c9c9af91f1d9a636aecc55302c792538e549a430< 51cefc9da400b953fee749c9e5d26cd4a2b5d758 affected
c9c9af91f1d9a636aecc55302c792538e549a430< 857ed800133ffcfcee28582090b63b0cbb8ba59d affected
c9c9af91f1d9a636aecc55302c792538e549a430< 63d814d93c5cce4c18284adc810028f28dca493f affected
c9c9af91f1d9a636aecc55302c792538e549a430< 5bfe7bf9656ed2633718388f12b7c38b86414a04 affected
c9c9af91f1d9a636aecc55302c792538e549a430< de1aaefa75be9d0ec19c9a3e0e2f9696de20c6ab affected
c9c9af91f1d9a636aecc55302c792538e549a430< d72dd6fcd7886d0523afbab8b4a4b22d17addd7d affected
c9c9af91f1d9a636aecc55302c792538e549a430< fb4e2b70a7194b209fc7320bbf33b375f7114bd5 affected
5.1 affected
… +8 条更多
获取后续新漏洞提醒 登录后订阅

一、 漏洞 CVE-2024-35852 基础信息

漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗

尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。

Vulnerability Title
mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work
来源: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work The rehash delayed work is rescheduled with a delay if the number of credits at end of the work is not negative as supposedly it means that the migration ended. Otherwise, it is rescheduled immediately. After "mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash" the above is no longer accurate as a non-negative number of credits is no longer indicative of the migration being done. It can also happen if the work encountered an error in which case the migration will resume the next time the work is scheduled. The significance of the above is that it is possible for the work to be pending and associated with hints that were allocated when the migration started. This leads to the hints being leaked [1] when the work is canceled while pending as part of ACL region dismantle. Fix by freeing the hints if hints are associated with a work that was canceled while pending. Blame the original commit since the reliance on not having a pending work associated with hints is fragile. [1] unreferenced object 0xffff88810e7c3000 (size 256): comm "kworker/0:16", pid 176, jiffies 4295460353 hex dump (first 32 bytes): 00 30 95 11 81 88 ff ff 61 00 00 00 00 00 00 80 .0......a....... 00 00 61 00 40 00 00 00 00 00 00 00 04 00 00 00 ..a.@........... backtrace (crc 2544ddb9): [<00000000cf8cfab3>] kmalloc_trace+0x23f/0x2a0 [<000000004d9a1ad9>] objagg_hints_get+0x42/0x390 [<000000000b143cf3>] mlxsw_sp_acl_erp_rehash_hints_get+0xca/0x400 [<0000000059bdb60a>] mlxsw_sp_acl_tcam_vregion_rehash_work+0x868/0x1160 [<00000000e81fd734>] process_one_work+0x59c/0xf20 [<00000000ceee9e81>] worker_thread+0x799/0x12c0 [<00000000bda6fe39>] kthread+0x246/0x300 [<0000000070056d23>] ret_from_fork+0x34/0x70 [<00000000dea2b93e>] ret_from_fork_asm+0x1a/0x30
来源: CVE Program / CVE List V5
CVSS Information
N/A
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于内存泄漏。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD

受影响产品

厂商 产品 影响版本 CPE 订阅
Linux Linux c9c9af91f1d9a636aecc55302c792538e549a430 ~ 51cefc9da400b953fee749c9e5d26cd4a2b5d758 -
Linux Linux 5.1 -

二、漏洞 CVE-2024-35852 的公开POC

# POC 描述 源链接 神龙链接
AI 生成 POC 高级

未找到公开 POC。

登录以生成 AI POC

三、漏洞 CVE-2024-35852 的情报信息

请登录查看更多情报信息。

CVE-2024-35852 邮件列表归档 (1)

CVE-2024-35852 其他参考 (7)

同批安全公告 · Linux · 2024-05-17 · 共 135 条

CVE-2023-52687 9.8 CRITICAL Linux kernel 安全漏洞
CVE-2024-35843 8.8 HIGH Linux kernel 安全漏洞
CVE-2024-35804 8.8 HIGH Linux kernel 安全漏洞
CVE-2024-35811 8.8 HIGH Linux kernel 安全漏洞
CVE-2024-27416 8.8 HIGH Linux kernel 安全漏洞
CVE-2024-27415 8.8 HIGH Linux kernel 安全漏洞
CVE-2024-35856 8.8 HIGH Linux kernel 安全漏洞
CVE-2024-35834 8.2 HIGH Linux kernel 安全漏洞
CVE-2024-27404 8.2 HIGH Linux kernel 安全漏洞
CVE-2023-52669 8.2 HIGH Linux kernel 安全漏洞
CVE-2024-35789 8.0 HIGH Linux kernel 安全漏洞
CVE-2024-35835 7.8 HIGH Linux kernel 安全漏洞
CVE-2024-35810 7.8 HIGH Linux kernel 安全漏洞
CVE-2024-35808 7.8 HIGH Linux kernel 安全漏洞
CVE-2023-52667 7.8 HIGH Linux kernel 安全漏洞
CVE-2024-35798 7.8 HIGH Linux kernel 安全漏洞
CVE-2024-35839 7.8 HIGH Linux kernel 安全漏洞
CVE-2024-35792 7.8 HIGH Linux kernel 安全漏洞
CVE-2024-27403 7.8 HIGH Linux kernel 安全漏洞
CVE-2024-35791 7.8 HIGH Linux kernel 安全漏洞

显示前 20 条，共 135 条。 查看全部 &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2024-35852

暂无评论

发表评论