Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2024-53183— um: net: Do not use drvdata in release

AI Predicted 7.8 Difficulty: Easy EPSS 0.25% · P16

Possible ATT&CK Techniques 1AI

T1203 · Exploitation for Client Execution

Affected Version Matrix 20

VendorProductVersion RangeStatus
LinuxLinux2e3f5251ac716879df6b6271f243f657c6e02e9a< b174ab33aaafd556a1ead72fa8e35d70b6fb1e39affected
2e3f5251ac716879df6b6271f243f657c6e02e9a< 8d9d174d3f55daaf5e7b48e9d7f53c723adbed86affected
2e3f5251ac716879df6b6271f243f657c6e02e9a< 6be99d4c117b9642a44d9f54f034b67615be2b2baffected
2e3f5251ac716879df6b6271f243f657c6e02e9a< 1635d9a0ff1b8bd7aa4767d4ea7b3de72cd36f28affected
2e3f5251ac716879df6b6271f243f657c6e02e9a< 160cd5f956d191eb97664afd31ca59284c08d876affected
2e3f5251ac716879df6b6271f243f657c6e02e9a< cdbd5a1dcdc2c27ac076f91b03b9add3fefa1a82affected
2e3f5251ac716879df6b6271f243f657c6e02e9a< 468c2e5394afc848efb1eae6e1961a3c855cf35eaffected
2e3f5251ac716879df6b6271f243f657c6e02e9a< f04cd022ee1fde219e0db1086c27a0a5ba1914dbaffected
… +12 more rows
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2024-53183

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
um: net: Do not use drvdata in release
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: um: net: Do not use drvdata in release The drvdata is not available in release. Let's just use container_of() to get the uml_net instance. Otherwise, removing a network device will result in a crash: RIP: 0033:net_device_release+0x10/0x6f RSP: 00000000e20c7c40 EFLAGS: 00010206 RAX: 000000006002e4e7 RBX: 00000000600f1baf RCX: 00000000624074e0 RDX: 0000000062778000 RSI: 0000000060551c80 RDI: 00000000627af028 RBP: 00000000e20c7c50 R08: 00000000603ad594 R09: 00000000e20c7b70 R10: 000000000000135a R11: 00000000603ad422 R12: 0000000000000000 R13: 0000000062c7af00 R14: 0000000062406d60 R15: 00000000627700b6 Kernel panic - not syncing: Segfault with no mm CPU: 0 UID: 0 PID: 29 Comm: kworker/0:2 Not tainted 6.12.0-rc6-g59b723cd2adb #1 Workqueue: events mc_work_proc Stack: 627af028 62c7af00 e20c7c80 60276fcd 62778000 603f5820 627af028 00000000 e20c7cb0 603a2bcd 627af000 62770010 Call Trace: [<60276fcd>] device_release+0x70/0xba [<603a2bcd>] kobject_put+0xba/0xe7 [<60277265>] put_device+0x19/0x1c [<60281266>] platform_device_put+0x26/0x29 [<60281e5f>] platform_device_unregister+0x2c/0x2e [<6002ec9c>] net_remove+0x63/0x69 [<60031316>] ? mconsole_reply+0x0/0x50 [<600310c8>] mconsole_remove+0x160/0x1cc [<60087d40>] ? __remove_hrtimer+0x38/0x74 [<60087ff8>] ? hrtimer_try_to_cancel+0x8c/0x98 [<6006b3cf>] ? dl_server_stop+0x3f/0x48 [<6006b390>] ? dl_server_stop+0x0/0x48 [<600672e8>] ? dequeue_entities+0x327/0x390 [<60038fa6>] ? um_set_signals+0x0/0x43 [<6003070c>] mc_work_proc+0x77/0x91 [<60057664>] process_scheduled_works+0x1b3/0x2dd [<60055f32>] ? assign_work+0x0/0x58 [<60057f0a>] worker_thread+0x1e9/0x293 [<6005406f>] ? set_pf_worker+0x0/0x64 [<6005d65d>] ? arch_local_irq_save+0x0/0x2d [<6005d748>] ? kthread_exit+0x0/0x3a [<60057d21>] ? worker_thread+0x0/0x293 [<6005dbf1>] kthread+0x126/0x12b [<600219c5>] new_thread_handler+0x85/0xb6
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于ALSA:usb-audio模块中Extigy和Mbox设备潜在的越界访问。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
LinuxLinux 2e3f5251ac716879df6b6271f243f657c6e02e9a ~ b174ab33aaafd556a1ead72fa8e35d70b6fb1e39 -
LinuxLinux 2.6.22 -

II. Public POCs for CVE-2024-53183

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-53183

请登录查看更多情报信息。

Patches & Fixes for CVE-2024-53183 (9)

Same Patch Batch · Linux · 2024-12-27 · 221 CVEs total

CVE-2024-531869.8 CRITICALksmbd: fix use-after-free in SMB request handling
CVE-2024-532099.8 CRITICALbnxt_en: Fix receive ring space parameters when XDP is active
CVE-2024-566409.8 CRITICALnet/smc: fix LGR and link use-after-free issue
CVE-2024-566459.8 CRITICALcan: j1939: j1939_session_new(): fix skb reference counting
CVE-2024-531699.8 CRITICALnvme-fabrics: fix kernel crash while shutting down controller
CVE-2024-531799.8 CRITICALsmb: client: fix use-after-free of signing key
CVE-2024-531779.8 CRITICALsmb: prevent use-after-free due to open_cached_dir error paths
CVE-2024-532069.8 CRITICALtcp: Fix use-after-free of nreq in reqsk_timer_handler().
CVE-2024-566569.8 CRITICALbnxt_en: Fix aggregation ID mask to prevent oops on 5760X chips
CVE-2024-531769.8 CRITICALsmb: During unmount, ensure all cached dir instances drop their dentry
CVE-2024-532248.8 HIGHRDMA/mlx5: Move events notifier registration to be after device registration
CVE-2024-566698.8 HIGHiommu/vt-d: Remove cache tags before disabling ATS
CVE-2024-532378.8 HIGHBluetooth: fix use-after-free in device_for_each_child()
CVE-2024-566268.8 HIGHksmbd: fix Out-of-Bounds Write in ksmbd_vfs_stream_write
CVE-2024-566538.8 HIGHBluetooth: btmtk: avoid UAF in btmtk_process_coredump
CVE-2024-566518.8 HIGHcan: hi311x: hi3110_can_ist(): fix potential use-after-free
CVE-2024-565918.8 HIGHBluetooth: hci_conn: Use disable_delayed_work_sync
CVE-2024-566278.1 HIGHksmbd: fix Out-of-Bounds Read in ksmbd_vfs_stream_read
CVE-2024-565557.8 HIGHbinder: fix OOB in binder_add_freeze_work()
CVE-2024-566067.8 HIGHaf_packet: avoid erroring out after sock_init_data() in packet_create()

Showing top 20 of 221 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2024-53183

No comments yet

Leave a comment