CVE-2024-35811

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2024-35811", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-17T12:19:12.342Z", "datePublished": "2024-05-17T13:23:17.508Z", "dateUpdated": "2026-10-15T00:40:54.307Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:30:05.862Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach\n\nThis is the candidate patch of CVE-2023-47233 :\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-47233\n\nIn brcm80211 driver,it starts with the following invoking chain\nto start init a timeout worker:\n\n->brcmf_usb_probe\n ->brcmf_usb_probe_cb\n ->brcmf_attach\n ->brcmf_bus_started\n ->brcmf_cfg80211_attach\n ->wl_init_priv\n ->brcmf_init_escan\n ->INIT_WORK(&cfg->escan_timeout_work,\n\t\t brcmf_cfg80211_escan_timeout_worker);\n\nIf we disconnect the USB by hotplug, it will call\nbrcmf_usb_disconnect to make cleanup. The invoking chain is :\n\nbrcmf_usb_disconnect\n ->brcmf_usb_disconnect_cb\n ->brcmf_detach\n ->brcmf_cfg80211_detach\n ->kfree(cfg);\n\nWhile the timeout woker may still be running. This will cause\na use-after-free bug on cfg in brcmf_cfg80211_escan_timeout_worker.\n\nFix it by deleting the timer and canceling the worker in\nbrcmf_cfg80211_detach.\n\n[arend.vanspriel@broadcom.com: keep timer delete as is and cancel work just before free]"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - The vulnerable free/use race is in a WiFi driver and is reached automatically via the firmware-crash recovery path (`brcmf_fw_crashed()` \u2192 `bus_reset` work \u2192 `brcmf_pcie_reset`/`brcmf_sdio_bus_reset` \u2192 `brcmf_detach` \u2192 `brcmf_cfg80211_detach` \u2192 `kfree(cfg)`), while the escan timeout worker fires precisely because the firmware stopped responding mid-scan. An adjacent 802.11 attacker who induces a firmware halt (a well-documented failure mode of Broadcom fullmac firmware when fed malformed frames) while the station is doing its routine background scanning triggers both sides of the race over the air.\nAC:L - The attacker controls both halves of the race \u2014 the stalled scan that guarantees the 10 s escan timer expires and the firmware halt that drives the detach \u2014 and the window is wide because the worker blocks in `brcmf_fil_cmd_data_set()` waiting on a dead firmware while `brcmf_cfg80211_detach()` frees `escan_buf` and `cfg` in parallel. The attempt is freely repeatable, and heap grooming of the freed 65000-byte buffer and `cfg` slab is standard.\nPR:N - No local account or capability is needed on the affected system: the scan is issued by the normal background supplicant/NetworkManager activity, and the detach is performed autonomously by the driver's bus-reset recovery worker in response to a firmware halt. The originally reported USB-hotplug variant likewise requires no privileges.\nUI:N - Background scanning by wpa_supplicant/NetworkManager is continuous and automatic, and the `brcmf_fw_crashed()` \u2192 bus-reset \u2192 detach sequence runs entirely inside the kernel without any user action. No victim interaction is required at any point.\nS:U - The use-after-free corrupts kernel heap objects and is exploited within the kernel's own security authority, with no crossing of a hypervisor, IOMMU, or sandbox boundary. Impact remains confined to the kernel that owns the vulnerable component.\nC:H - After the free, `brcmf_inform_bss()` walks the dangling `escan_info.escan_buf` with a length/count taken from reallocated memory, giving controlled out-of-bounds reads, and `brcmf_inform_single_bss()` hands the resulting `notify_ie`/`notify_ielen` to `cfg80211_inform_bss_data()`, which copies that kernel memory into a BSS entry retrievable by userspace via nl80211. This is an arbitrary kernel-memory read with a direct exfiltration channel.\nI:H - The worker performs an indirect call through `cfg->d11inf.decchspec`, a function pointer loaded from the freed `cfg` object, giving control-flow hijack once the slab is reallocated with attacker-controlled data, and it also writes into freed memory (`bi->ctl_ch`, `cfg->scan_request = NULL`, `timer_delete_sync()` on a freed `timer_list`). Combined with the stale `ifp` and `scan_request` passed into further kernel calls, this yields write and code-execution primitives.\nA:H - Even without full exploitation, dereferencing the freed `cfg`, freed `escan_buf`, and freed `brcmf_if`, and running `timer_delete_sync()`/`cfg80211_scan_done()` on freed structures, reliably produces oopses, slab corruption, and kernel panic. The WiFi interface is destroyed and the system crashes."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c"], "versions": [{"version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62", "lessThan": "202c503935042272e2f9e1bb549d5f69a8681169", "status": "affected", "versionType": "git"}, {"version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62", "lessThan": "8e3f03f4ef7c36091f46e7349096efb5a2cdb3a1", "status": "affected", "versionType": "git"}, {"version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62", "lessThan": "bacb8c3ab86dcd760c15903fcee58169bc3026aa", "status": "affected", "versionType": "git"}, {"version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62", "lessThan": "8c36205123dc57349b59b4f1a2301eb278cbc731", "status": "affected", "versionType": "git"}, {"version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62", "lessThan": "0b812f706fd7090be74812101114a0e165b36744", "status": "affected", "versionType": "git"}, {"version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62", "lessThan": "190794848e2b9d15de92d502b6ac652806904f5a", "status": "affected", "versionType": "git"}, {"version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62", "lessThan": "6678a1e7d896c00030b31491690e8ddc9a90767a", "status": "affected", "versionType": "git"}, {"version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62", "lessThan": "0a7591e14a8da794d0b93b5d1c6254ccb23adacb", "status": "affected", "versionType": "git"}, {"version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62", "lessThan": "0f7352557a35ab7888bc7831411ec8a3cbe20d78", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c"], "versions": [{"version": "3.7", "status": "affected"}, {"version": "0", "lessThan": "3.7", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.312", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.274", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.215", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.154", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.84", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.24", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.12", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.3", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "4.19.312"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "5.4.274"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "5.10.215"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "5.15.154"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.1.84"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.6.24"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.7.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.8.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.9"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/202c503935042272e2f9e1bb549d5f69a8681169"}, {"url": "https://git.kernel.org/stable/c/8e3f03f4ef7c36091f46e7349096efb5a2cdb3a1"}, {"url": "https://git.kernel.org/stable/c/bacb8c3ab86dcd760c15903fcee58169bc3026aa"}, {"url": "https://git.kernel.org/stable/c/8c36205123dc57349b59b4f1a2301eb278cbc731"}, {"url": "https://git.kernel.org/stable/c/0b812f706fd7090be74812101114a0e165b36744"}, {"url": "https://git.kernel.org/stable/c/190794848e2b9d15de92d502b6ac652806904f5a"}, {"url": "https://git.kernel.org/stable/c/6678a1e7d896c00030b31491690e8ddc9a90767a"}, {"url": "https://git.kernel.org/stable/c/0a7591e14a8da794d0b93b5d1c6254ccb23adacb"}, {"url": "https://git.kernel.org/stable/c/0f7352557a35ab7888bc7831411ec8a3cbe20d78"}], "title": "wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:21:47.516Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/202c503935042272e2f9e1bb549d5f69a8681169", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8e3f03f4ef7c36091f46e7349096efb5a2cdb3a1", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/bacb8c3ab86dcd760c15903fcee58169bc3026aa", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8c36205123dc57349b59b4f1a2301eb278cbc731", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0b812f706fd7090be74812101114a0e165b36744", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/190794848e2b9d15de92d502b6ac652806904f5a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/6678a1e7d896c00030b31491690e8ddc9a90767a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0a7591e14a8da794d0b93b5d1c6254ccb23adacb", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0f7352557a35ab7888bc7831411ec8a3cbe20d78", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-35811", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:42:35.275433Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:32:51.552Z"}}, {"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T00:40:54.307Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.1.1", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}]}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/202c503935042272e2f9e1bb549d5f69a8681169", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8e3f03f4ef7c36091f46e7349096efb5a2cdb3a1", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/bacb8c3ab86dcd760c15903fcee58169bc3026aa", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8c36205123dc57349b59b4f1a2301eb278cbc731", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0b812f706fd7090be74812101114a0e165b36744", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/190794848e2b9d15de92d502b6ac652806904f5a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/6678a1e7d896c00030b31491690e8ddc9a90767a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0a7591e14a8da794d0b93b5d1c6254ccb23adacb", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0f7352557a35ab7888bc7831411ec8a3cbe20d78", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:21:47.516Z"}}, {"affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.1.1", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T00:40:54.307Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-35811", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:42:35.275433Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:13.106Z"}}], "cna": {"title": "wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:A - The vulnerable free/use race is in a WiFi driver and is reached automatically via the firmware-crash recovery path (`brcmf_fw_crashed()` \u2192 `bus_reset` work \u2192 `brcmf_pcie_reset`/`brcmf_sdio_bus_reset` \u2192 `brcmf_detach` \u2192 `brcmf_cfg80211_detach` \u2192 `kfree(cfg)`), while the escan timeout worker fires precisely because the firmware stopped responding mid-scan. An adjacent 802.11 attacker who induces a firmware halt (a well-documented failure mode of Broadcom fullmac firmware when fed malformed frames) while the station is doing its routine background scanning triggers both sides of the race over the air.\nAC:L - The attacker controls both halves of the race \u2014 the stalled scan that guarantees the 10 s escan timer expires and the firmware halt that drives the detach \u2014 and the window is wide because the worker blocks in `brcmf_fil_cmd_data_set()` waiting on a dead firmware while `brcmf_cfg80211_detach()` frees `escan_buf` and `cfg` in parallel. The attempt is freely repeatable, and heap grooming of the freed 65000-byte buffer and `cfg` slab is standard.\nPR:N - No local account or capability is needed on the affected system: the scan is issued by the normal background supplicant/NetworkManager activity, and the detach is performed autonomously by the driver's bus-reset recovery worker in response to a firmware halt. The originally reported USB-hotplug variant likewise requires no privileges.\nUI:N - Background scanning by wpa_supplicant/NetworkManager is continuous and automatic, and the `brcmf_fw_crashed()` \u2192 bus-reset \u2192 detach sequence runs entirely inside the kernel without any user action. No victim interaction is required at any point.\nS:U - The use-after-free corrupts kernel heap objects and is exploited within the kernel's own security authority, with no crossing of a hypervisor, IOMMU, or sandbox boundary. Impact remains confined to the kernel that owns the vulnerable component.\nC:H - After the free, `brcmf_inform_bss()` walks the dangling `escan_info.escan_buf` with a length/count taken from reallocated memory, giving controlled out-of-bounds reads, and `brcmf_inform_single_bss()` hands the resulting `notify_ie`/`notify_ielen` to `cfg80211_inform_bss_data()`, which copies that kernel memory into a BSS entry retrievable by userspace via nl80211. This is an arbitrary kernel-memory read with a direct exfiltration channel.\nI:H - The worker performs an indirect call through `cfg->d11inf.decchspec`, a function pointer loaded from the freed `cfg` object, giving control-flow hijack once the slab is reallocated with attacker-controlled data, and it also writes into freed memory (`bi->ctl_ch`, `cfg->scan_request = NULL`, `timer_delete_sync()` on a freed `timer_list`). Combined with the stale `ifp` and `scan_request` passed into further kernel calls, this yields write and code-execution primitives.\nA:H - Even without full exploitation, dereferencing the freed `cfg`, freed `escan_buf`, and freed `brcmf_if`, and running `timer_delete_sync()`/`cfg80211_scan_done()` on freed structures, reliably produces oopses, slab corruption, and kernel panic. The WiFi interface is destroyed and the system crashes."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62", "lessThan": "202c503935042272e2f9e1bb549d5f69a8681169", "versionType": "git"}, {"status": "affected", "version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62", "lessThan": "8e3f03f4ef7c36091f46e7349096efb5a2cdb3a1", "versionType": "git"}, {"status": "affected", "version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62", "lessThan": "bacb8c3ab86dcd760c15903fcee58169bc3026aa", "versionType": "git"}, {"status": "affected", "version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62", "lessThan": "8c36205123dc57349b59b4f1a2301eb278cbc731", "versionType": "git"}, {"status": "affected", "version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62", "lessThan": "0b812f706fd7090be74812101114a0e165b36744", "versionType": "git"}, {"status": "affected", "version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62", "lessThan": "190794848e2b9d15de92d502b6ac652806904f5a", "versionType": "git"}, {"status": "affected", "version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62", "lessThan": "6678a1e7d896c00030b31491690e8ddc9a90767a", "versionType": "git"}, {"status": "affected", "version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62", "lessThan": "0a7591e14a8da794d0b93b5d1c6254ccb23adacb", "versionType": "git"}, {"status": "affected", "version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62", "lessThan": "0f7352557a35ab7888bc7831411ec8a3cbe20d78", "versionType": "git"}], "programFiles": ["drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.7"}, {"status": "unaffected", "version": "0", "lessThan": "3.7", "versionType": "semver"}, {"status": "unaffected", "version": "4.19.312", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.274", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.215", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.154", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.84", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.24", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7.12", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8.3", "versionType": "semver", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/202c503935042272e2f9e1bb549d5f69a8681169"}, {"url": "https://git.kernel.org/stable/c/8e3f03f4ef7c36091f46e7349096efb5a2cdb3a1"}, {"url": "https://git.kernel.org/stable/c/bacb8c3ab86dcd760c15903fcee58169bc3026aa"}, {"url": "https://git.kernel.org/stable/c/8c36205123dc57349b59b4f1a2301eb278cbc731"}, {"url": "https://git.kernel.org/stable/c/0b812f706fd7090be74812101114a0e165b36744"}, {"url": "https://git.kernel.org/stable/c/190794848e2b9d15de92d502b6ac652806904f5a"}, {"url": "https://git.kernel.org/stable/c/6678a1e7d896c00030b31491690e8ddc9a90767a"}, {"url": "https://git.kernel.org/stable/c/0a7591e14a8da794d0b93b5d1c6254ccb23adacb"}, {"url": "https://git.kernel.org/stable/c/0f7352557a35ab7888bc7831411ec8a3cbe20d78"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach\n\nThis is the candidate patch of CVE-2023-47233 :\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-47233\n\nIn brcm80211 driver,it starts with the following invoking chain\nto start init a timeout worker:\n\n->brcmf_usb_probe\n ->brcmf_usb_probe_cb\n ->brcmf_attach\n ->brcmf_bus_started\n ->brcmf_cfg80211_attach\n ->wl_init_priv\n ->brcmf_init_escan\n ->INIT_WORK(&cfg->escan_timeout_work,\n\t\t brcmf_cfg80211_escan_timeout_worker);\n\nIf we disconnect the USB by hotplug, it will call\nbrcmf_usb_disconnect to make cleanup. The invoking chain is :\n\nbrcmf_usb_disconnect\n ->brcmf_usb_disconnect_cb\n ->brcmf_detach\n ->brcmf_cfg80211_detach\n ->kfree(cfg);\n\nWhile the timeout woker may still be running. This will cause\na use-after-free bug on cfg in brcmf_cfg80211_escan_timeout_worker.\n\nFix it by deleting the timer and canceling the worker in\nbrcmf_cfg80211_detach.\n\n[arend.vanspriel@broadcom.com: keep timer delete as is and cancel work just before free]"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.312", "versionStartIncluding": "3.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.274", "versionStartIncluding": "3.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.215", "versionStartIncluding": "3.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.154", "versionStartIncluding": "3.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.84", "versionStartIncluding": "3.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.24", "versionStartIncluding": "3.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.7.12", "versionStartIncluding": "3.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8.3", "versionStartIncluding": "3.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9", "versionStartIncluding": "3.7"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:30:05.862Z"}}}, "cveMetadata": {"cveId": "CVE-2024-35811", "state": "PUBLISHED", "dateUpdated": "2026-10-15T00:40:54.307Z", "dateReserved": "2024-05-17T12:19:12.342Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-17T13:23:17.508Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "202c503935042272e2f9e1bb549d5f69a8681169", "status": "affected", "version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62", "versionType": "git"}, {"lessThan": "8e3f03f4ef7c36091f46e7349096efb5a2cdb3a1", "status": "affected", "version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62", "versionType": "git"}, {"lessThan": "bacb8c3ab86dcd760c15903fcee58169bc3026aa", "status": "affected", "version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62", "versionType": "git"}, {"lessThan": "8c36205123dc57349b59b4f1a2301eb278cbc731", "status": "affected", "version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62", "versionType": "git"}, {"lessThan": "0b812f706fd7090be74812101114a0e165b36744", "status": "affected", "version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62", "versionType": "git"}, {"lessThan": "190794848e2b9d15de92d502b6ac652806904f5a", "status": "affected", "version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62", "versionType": "git"}, {"lessThan": "6678a1e7d896c00030b31491690e8ddc9a90767a", "status": "affected", "version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62", "versionType": "git"}, {"lessThan": "0a7591e14a8da794d0b93b5d1c6254ccb23adacb", "status": "affected", "version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62", "versionType": "git"}, {"lessThan": "0f7352557a35ab7888bc7831411ec8a3cbe20d78", "status": "affected", "version": "e756af5b30b008f6ffcfebf8ad0b477f6f225b62", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.7"}, {"lessThan": "3.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.312", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.274", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.215", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.154", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.84", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.24", "versionType": "semver"}, {"lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.12", "versionType": "semver"}, {"lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "V1.1.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "48A978A1-082D-4FD8-B0A8-15D857F7935B", "versionEndExcluding": "4.19.312", "versionStartIncluding": "3.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F45A0F3C-C16D-49C4-86D6-D021C3D4B834", "versionEndExcluding": "5.4.274", "versionStartIncluding": "4.20", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9CD5894E-58E9-4B4A-B0F4-3E6BC134B8F5", "versionEndExcluding": "5.10.215", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "577E212E-7E95-4A71-9B5C-F1D1A3AFFF46", "versionEndExcluding": "5.15.154", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "834D9BD5-42A6-4D74-979E-4D6D93F630FD", "versionEndExcluding": "6.1.84", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8018C1D0-0A5F-48D0-BC72-A2B33FDDA693", "versionEndExcluding": "6.6.24", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6BE9771A-BAFD-4624-95F9-58D536540C53", "versionEndExcluding": "6.7.12", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4C59BBC3-6495-4A77-9C82-55EC7CDF5E02", "versionEndExcluding": "6.8.3", "versionStartIncluding": "6.8", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach\n\nThis is the candidate patch of CVE-2023-47233 :\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-47233\n\nIn brcm80211 driver,it starts with the following invoking chain\nto start init a timeout worker:\n\n->brcmf_usb_probe\n ->brcmf_usb_probe_cb\n ->brcmf_attach\n ->brcmf_bus_started\n ->brcmf_cfg80211_attach\n ->wl_init_priv\n ->brcmf_init_escan\n ->INIT_WORK(&cfg->escan_timeout_work,\n\t\t brcmf_cfg80211_escan_timeout_worker);\n\nIf we disconnect the USB by hotplug, it will call\nbrcmf_usb_disconnect to make cleanup. The invoking chain is :\n\nbrcmf_usb_disconnect\n ->brcmf_usb_disconnect_cb\n ->brcmf_detach\n ->brcmf_cfg80211_detach\n ->kfree(cfg);\n\nWhile the timeout woker may still be running. This will cause\na use-after-free bug on cfg in brcmf_cfg80211_escan_timeout_worker.\n\nFix it by deleting the timer and canceling the worker in\nbrcmf_cfg80211_detach.\n\n[arend.vanspriel@broadcom.com: keep timer delete as is and cancel work just before free]"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: brcmfmac: corregido el error de use after free en brcmf_cfg80211_detach Este es el parche candidato de CVE-2023-47233: https://nvd.nist.gov/vuln/detail /CVE-2023-47233 En el controlador brcm80211, comienza con la siguiente cadena de invocaci\u00f3n para iniciar un trabajador de tiempo de espera: ->brcmf_usb_probe ->brcmf_usb_probe_cb ->brcmf_attach ->brcmf_bus_started ->brcmf_cfg80211_attach ->wl_init_priv ->brcmf_init_escan ->INIT_WORK(&cfg ->escan_timeout_work, brcmf_cfg80211_escan_timeout_worker); Si desconectamos el USB mediante hotplug, llamar\u00e1 a brcmf_usb_disconnect para realizar la limpieza. La cadena de invocaci\u00f3n es: brcmf_usb_disconnect ->brcmf_usb_disconnect_cb ->brcmf_detach ->brcmf_cfg80211_detach ->kfree(cfg); Mientras que el activador de tiempo de espera a\u00fan puede estar ejecut\u00e1ndose. Esto provocar\u00e1 un error de use after free en cfg en brcmf_cfg80211_escan_timeout_worker. Soluci\u00f3nelo eliminando el temporizador y cancelando el trabajador en brcmf_cfg80211_detach. [arend.vanspriel@broadcom.com: mantenga la eliminaci\u00f3n del temporizador tal como est\u00e1 y cancele el trabajo justo antes de liberarlo]"}], "id": "CVE-2024-35811", "lastModified": "2026-10-15T01:17:47.423", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-35811", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T15:42:35.275433Z", "version": "2.0.3"}}]}, "published": "2024-05-17T14:15:15.177", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0a7591e14a8da794d0b93b5d1c6254ccb23adacb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0b812f706fd7090be74812101114a0e165b36744"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0f7352557a35ab7888bc7831411ec8a3cbe20d78"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/190794848e2b9d15de92d502b6ac652806904f5a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/202c503935042272e2f9e1bb549d5f69a8681169"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6678a1e7d896c00030b31491690e8ddc9a90767a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8c36205123dc57349b59b4f1a2301eb278cbc731"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8e3f03f4ef7c36091f46e7349096efb5a2cdb3a1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bacb8c3ab86dcd760c15903fcee58169bc3026aa"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0a7591e14a8da794d0b93b5d1c6254ccb23adacb"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0b812f706fd7090be74812101114a0e165b36744"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0f7352557a35ab7888bc7831411ec8a3cbe20d78"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/190794848e2b9d15de92d502b6ac652806904f5a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/202c503935042272e2f9e1bb549d5f69a8681169"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6678a1e7d896c00030b31491690e8ddc9a90767a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8c36205123dc57349b59b4f1a2301eb278cbc731"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8e3f03f4ef7c36091f46e7349096efb5a2cdb3a1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bacb8c3ab86dcd760c15903fcee58169bc3026aa"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach", "id": "2281213", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2281213"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach\nThis is the candidate patch of CVE-2023-47233 :\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-47233\nIn brcm80211 driver,it starts with the following invoking chain\nto start init a timeout worker:\n->brcmf_usb_probe\n->brcmf_usb_probe_cb\n->brcmf_attach\n->brcmf_bus_started\n->brcmf_cfg80211_attach\n->wl_init_priv\n->brcmf_init_escan\n->INIT_WORK(&cfg->escan_timeout_work,\nbrcmf_cfg80211_escan_timeout_worker);\nIf we disconnect the USB by hotplug, it will call\nbrcmf_usb_disconnect to make cleanup. The invoking chain is :\nbrcmf_usb_disconnect\n->brcmf_usb_disconnect_cb\n->brcmf_detach\n->brcmf_cfg80211_detach\n->kfree(cfg);\nWhile the timeout woker may still be running. This will cause\na use-after-free bug on cfg in brcmf_cfg80211_escan_timeout_worker.\nFix it by deleting the timer and canceling the worker in\nbrcmf_cfg80211_detach.\n[arend.vanspriel@broadcom.com: keep timer delete as is and cancel work just before free]", "A use-after-free vulnerability was found in the `brcmf_cfg80211_detach` function of the `brcmfmac` driver in the Linux Kernel, which could lead to security risks or system instability. This issue was resolved to prevent unauthorized access to freed memory that could have been exploited for malicious purposes."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-35811", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-17T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-35811\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-35811\nhttps://lore.kernel.org/linux-cve-announce/2024051741-CVE-2024-35811-9306@gregkh/T"], "statement": "Red Hat Enterprise Linux is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux kernel used in its distributions.", "threat_severity": "Moderate"}

{}