cve-2024-38611
Vulnerability from cvelistv5
Published
2024-06-19 13:56
Modified
2024-11-05 09:30
Severity ?
Summary
media: i2c: et8ek8: Don't strip remove function when driver is builtin
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/43fff07e4b1956d0e5cf23717507e438278ea3d9
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/545b215736c5c4b354e182d99c578a472ac9bfce
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/904db2ba44ae60641b6378c5013254d09acf5e80
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c1a3803e5bb91c13e9ad582003e4288f67f06cd9
Impacted products
Vendor Product Version
Linux Linux Version: 4.11
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:12:26.122Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c1a3803e5bb91c13e9ad582003e4288f67f06cd9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/43fff07e4b1956d0e5cf23717507e438278ea3d9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/904db2ba44ae60641b6378c5013254d09acf5e80"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/545b215736c5c4b354e182d99c578a472ac9bfce"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38611",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:13:05.584089Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:53.519Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/i2c/et8ek8/et8ek8_driver.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c1a3803e5bb9",
              "status": "affected",
              "version": "c5254e72b8ed",
              "versionType": "git"
            },
            {
              "lessThan": "43fff07e4b19",
              "status": "affected",
              "version": "c5254e72b8ed",
              "versionType": "git"
            },
            {
              "lessThan": "904db2ba44ae",
              "status": "affected",
              "version": "c5254e72b8ed",
              "versionType": "git"
            },
            {
              "lessThan": "545b215736c5",
              "status": "affected",
              "version": "c5254e72b8ed",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/i2c/et8ek8/et8ek8_driver.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: i2c: et8ek8: Don\u0027t strip remove function when driver is builtin\n\nUsing __exit for the remove function results in the remove callback\nbeing discarded with CONFIG_VIDEO_ET8EK8=y. When such a device gets\nunbound (e.g. using sysfs or hotplug), the driver is just removed\nwithout the cleanup being performed. This results in resource leaks. Fix\nit by compiling in the remove callback unconditionally.\n\nThis also fixes a W=1 modpost warning:\n\n\tWARNING: modpost: drivers/media/i2c/et8ek8/et8ek8: section mismatch in reference: et8ek8_i2c_driver+0x10 (section: .data) -\u003e et8ek8_remove (section: .exit.text)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-05T09:30:55.833Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c1a3803e5bb91c13e9ad582003e4288f67f06cd9"
        },
        {
          "url": "https://git.kernel.org/stable/c/43fff07e4b1956d0e5cf23717507e438278ea3d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/904db2ba44ae60641b6378c5013254d09acf5e80"
        },
        {
          "url": "https://git.kernel.org/stable/c/545b215736c5c4b354e182d99c578a472ac9bfce"
        }
      ],
      "title": "media: i2c: et8ek8: Don\u0027t strip remove function when driver is builtin",
      "x_generator": {
        "engine": "bippy-9e1c9544281a"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-38611",
    "datePublished": "2024-06-19T13:56:12.742Z",
    "dateReserved": "2024-06-18T19:36:34.942Z",
    "dateUpdated": "2024-11-05T09:30:55.833Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-38611\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-06-19T14:15:20.980\",\"lastModified\":\"2024-06-20T12:43:25.663\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmedia: i2c: et8ek8: Don\u0027t strip remove function when driver is builtin\\n\\nUsing __exit for the remove function results in the remove callback\\nbeing discarded with CONFIG_VIDEO_ET8EK8=y. When such a device gets\\nunbound (e.g. using sysfs or hotplug), the driver is just removed\\nwithout the cleanup being performed. This results in resource leaks. Fix\\nit by compiling in the remove callback unconditionally.\\n\\nThis also fixes a W=1 modpost warning:\\n\\n\\tWARNING: modpost: drivers/media/i2c/et8ek8/et8ek8: section mismatch in reference: et8ek8_i2c_driver+0x10 (section: .data) -\u003e et8ek8_remove (section: .exit.text)\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: medios: i2c: et8ek8: No eliminar la funci\u00f3n de eliminaci\u00f3n cuando el controlador est\u00e1 integrado. El uso de __exit para la funci\u00f3n de eliminaci\u00f3n hace que la devoluci\u00f3n de llamada de eliminaci\u00f3n se descarte con CONFIG_VIDEO_ET8EK8=y. Cuando un dispositivo de este tipo se desvincula (por ejemplo, usando sysfs o hotplug), el controlador simplemente se elimina sin que se realice la limpieza. Esto da como resultado fugas de recursos. Solucionarlo compilando la devoluci\u00f3n de llamada de eliminaci\u00f3n incondicionalmente. Esto tambi\u00e9n corrige una advertencia de modpost W=1: ADVERTENCIA: modpost: drivers/media/i2c/et8ek8/et8ek8: secci\u00f3n no coincide en referencia: et8ek8_i2c_driver+0x10 (secci\u00f3n: .data) -\u0026gt; et8ek8_remove (secci\u00f3n: .exit.text)\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/43fff07e4b1956d0e5cf23717507e438278ea3d9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/545b215736c5c4b354e182d99c578a472ac9bfce\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/904db2ba44ae60641b6378c5013254d09acf5e80\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c1a3803e5bb91c13e9ad582003e4288f67f06cd9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.