CVE-2024-39478 (GCVE-0-2024-39478)
Vulnerability from cvelistv5
Published
2024-07-05 06:55
Modified
2026-08-05 11:33
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: crypto: starfive - Do not free stack buffer RSA text data uses variable length buffer allocated in software stack. Calling kfree on it causes undefined behaviour in subsequent operations.
References
Impacted products
Vendor Product Version
Linux Linux Version: 445a4aaf5842073e4130b1d6dbe3785284d9615f
Version: 445a4aaf5842073e4130b1d6dbe3785284d9615f
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-39478",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-08T14:13:27.969943Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-08T14:13:38.169Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:26:16.166Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5944de192663f272033501dcd322b008fca72006"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d7f01649f4eaf1878472d3d3f480ae1e50d98f6c"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/starfive/jh7110-rsa.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5944de192663f272033501dcd322b008fca72006",
              "status": "affected",
              "version": "445a4aaf5842073e4130b1d6dbe3785284d9615f",
              "versionType": "git"
            },
            {
              "lessThan": "d7f01649f4eaf1878472d3d3f480ae1e50d98f6c",
              "status": "affected",
              "version": "445a4aaf5842073e4130b1d6dbe3785284d9615f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/starfive/jh7110-rsa.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.5",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: starfive - Do not free stack buffer\n\nRSA text data uses variable length buffer allocated in software stack.\nCalling kfree on it causes undefined behaviour in subsequent operations."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached through the keyctl() syscall (KEYCTL_PKEY_ENCRYPT/DECRYPT/SIGN/VERIFY) on a locally added asymmetric key, requiring local access to the affected StarFive JH7110 system. No network-facing kernel path drives akcipher RSA operations.\nAC:L - The invalid kfree() executes unconditionally on every RSA operation, on both the success and error paths, so the attacker triggers it deterministically with a single syscall and can repeat it arbitrarily to groom the slab. The attacker also controls the contents of the wrongly-freed memory, since the RSA plaintext is copied into rsa_data.\nPR:L - Any unprivileged user can add an X.509/asymmetric key to their own session keyring and invoke KEYCTL_PKEY_* on it; the only check is KEY_NEED_SEARCH on a key they own, with no capability requirement.\nUI:N - Exploitation is entirely attacker-driven via syscalls in the attacker\u0027s own process; no victim action or interaction is needed.\nS:U - The corruption is confined to the kernel\u0027s own slab allocator within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - Freeing an interior pointer places a misaligned address on the SLUB freelist, so a subsequent allocation overlaps the still-live request buffer, yielding attacker-readable aliasing of kernel heap memory that can be leveraged for arbitrary kernel memory disclosure.\nI:H - The invalid free writes a freepointer into the middle of a live object and creates overlapping/double-freed allocations whose contents the attacker controls, a classic heap-corruption primitive leading to arbitrary write and privilege escalation.\nA:H - Freelist corruption from freeing a non-slab-aligned pointer reliably causes kernel oops/panic, and the operation can be repeated at will to guarantee a crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:33:31.863Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5944de192663f272033501dcd322b008fca72006"
        },
        {
          "url": "https://git.kernel.org/stable/c/d7f01649f4eaf1878472d3d3f480ae1e50d98f6c"
        }
      ],
      "title": "crypto: starfive - Do not free stack buffer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-39478",
    "datePublished": "2024-07-05T06:55:07.936Z",
    "dateReserved": "2024-06-25T14:23:23.746Z",
    "dateUpdated": "2026-08-05T11:33:31.863Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/5944de192663f272033501dcd322b008fca72006\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d7f01649f4eaf1878472d3d3f480ae1e50d98f6c\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:26:16.166Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-39478\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-07-08T14:13:27.969943Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-08T14:13:35.173Z\"}}], \"cna\": {\"title\": \"crypto: starfive - Do not free stack buffer\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable code is reached through the keyctl() syscall (KEYCTL_PKEY_ENCRYPT/DECRYPT/SIGN/VERIFY) on a locally added asymmetric key, requiring local access to the affected StarFive JH7110 system. No network-facing kernel path drives akcipher RSA operations.\\nAC:L - The invalid kfree() executes unconditionally on every RSA operation, on both the success and error paths, so the attacker triggers it deterministically with a single syscall and can repeat it arbitrarily to groom the slab. The attacker also controls the contents of the wrongly-freed memory, since the RSA plaintext is copied into rsa_data.\\nPR:L - Any unprivileged user can add an X.509/asymmetric key to their own session keyring and invoke KEYCTL_PKEY_* on it; the only check is KEY_NEED_SEARCH on a key they own, with no capability requirement.\\nUI:N - Exploitation is entirely attacker-driven via syscalls in the attacker\u0027s own process; no victim action or interaction is needed.\\nS:U - The corruption is confined to the kernel\u0027s own slab allocator within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\\nC:H - Freeing an interior pointer places a misaligned address on the SLUB freelist, so a subsequent allocation overlaps the still-live request buffer, yielding attacker-readable aliasing of kernel heap memory that can be leveraged for arbitrary kernel memory disclosure.\\nI:H - The invalid free writes a freepointer into the middle of a live object and creates overlapping/double-freed allocations whose contents the attacker controls, a classic heap-corruption primitive leading to arbitrary write and privilege escalation.\\nA:H - Freelist corruption from freeing a non-slab-aligned pointer reliably causes kernel oops/panic, and the operation can be repeated at will to guarantee a crash.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"445a4aaf5842073e4130b1d6dbe3785284d9615f\", \"lessThan\": \"5944de192663f272033501dcd322b008fca72006\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"445a4aaf5842073e4130b1d6dbe3785284d9615f\", \"lessThan\": \"d7f01649f4eaf1878472d3d3f480ae1e50d98f6c\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/crypto/starfive/jh7110-rsa.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.5\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.5\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.9.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/crypto/starfive/jh7110-rsa.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/5944de192663f272033501dcd322b008fca72006\"}, {\"url\": \"https://git.kernel.org/stable/c/d7f01649f4eaf1878472d3d3f480ae1e50d98f6c\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncrypto: starfive - Do not free stack buffer\\n\\nRSA text data uses variable length buffer allocated in software stack.\\nCalling kfree on it causes undefined behaviour in subsequent operations.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.5\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"6.5\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:33:31.863Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-39478\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:33:31.863Z\", \"dateReserved\": \"2024-06-25T14:23:23.746Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-05T06:55:07.936Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.