CVE-2024-35811: wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-17 · updated 2026-10-15
Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach This is the candidate patch of CVE-2023-47233 : https://nvd.nist.gov/vuln/detail/CVE-2023-47233 In brcm80211 driver,it starts with the following invoking chain to start init a timeout worker: ->brcmf_usb_probe ->brcmf_usb_probe_cb ->brcmf_attach ->brcmf_bus_started ->brcmf_cfg80211_attach ->wl_init_priv ->brcmf_init_escan ->INIT_WORK(&cfg->escan_timeout_work, brcmf_cfg80211_escan_timeout_worker); If we disconnect the USB by hotplug, it will call brcmf_usb_disconnect to make cleanup. The invoking chain is : brcmf_usb_disconnect ->brcmf_usb_disconnect_cb ->brcmf_detach ->brcmf_cfg80211_detach ->kfree(cfg); While the timeout woker may still be running. This will cause a use-after-free bug on cfg in brcmf_cfg80211_escan_timeout_worker. Fix it by deleting the timer and canceling the worker in brcmf_cfg80211_detach. [arend.vanspriel@broadcom.com: keep timer delete as is and cancel work just before free]

Affected products

Debian Linux: 10.0
Linux kernel: from 3.7 before 4.19.312; from 4.20 before 5.4.274; from 5.5 before 5.10.215; from 5.11 before 5.15.154; from 5.16 before 6.1.84; from 6.2 before 6.6.24 — fixed in 4.19.312, 5.10.215, 5.15.154, 5.4.274, 6.1.84, 6.6.24

How to fix

Upgrade to a fixed version: Linux kernel 4.19.312, 5.10.215, 5.15.154, 5.4.274. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-35811 or the next vulnerability affects your stack