CVE-2024-38575 wifi: brcmfmac: pcie: handle randbuf allocation failure

2024-06-1913:37:34

Linux

github.com

linux kernel

wifi

brcmfmac

pcie

vulnerability

allocation failure

buffer

kernel stack

cve

AI Score

6.6

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: pcie: handle randbuf allocation failure

The kzalloc() in brcmf_pcie_download_fw_nvram() will return null
if the physical memory has run out. As a result, if we use
get_random_bytes() to generate random bytes in the randbuf, the
null pointer dereference bug will happen.

In order to prevent allocation failure, this patch adds a separate
function using buffer on kernel stack to generate random bytes in
the randbuf, which could prevent the kernel stack from overflow.

CNA Affected

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "c35105f375b5",
        "lessThan": "0eb2c0528e23",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "91918ce88d9f",
        "lessThan": "c37466406f07",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "91918ce88d9f",
        "lessThan": "7c15eb344b0d",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "91918ce88d9f",
        "lessThan": "3729ca9e48d1",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "91918ce88d9f",
        "lessThan": "316f790ebcf9",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "6.4"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "6.4",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "6.1.93",
        "versionType": "custom",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.33",
        "versionType": "custom",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.8.12",
        "versionType": "custom",
        "lessThanOrEqual": "6.8.*"
      },
      {
        "status": "unaffected",
        "version": "6.9.3",
        "versionType": "custom",
        "lessThanOrEqual": "6.9.*"
      },
      {
        "status": "unaffected",
        "version": "6.10",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c"
    ],
    "defaultStatus": "affected"
  }
]