CVE-2024-39282

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-39282", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-01-15T13:08:59.721Z", "datePublished": "2025-01-15T13:10:21.320Z", "dateUpdated": "2026-08-05T11:33:21.093Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:33:21.093Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: wwan: t7xx: Fix FSM command timeout issue\n\nWhen driver processes the internal state change command, it use an\nasynchronous thread to process the command operation. If the main\nthread detects that the task has timed out, the asynchronous thread\nwill panic when executing the completion notification because the\nmain thread completion object has been released.\n\nBUG: unable to handle page fault for address: fffffffffffffff8\nPGD 1f283a067 P4D 1f283a067 PUD 1f283c067 PMD 0\nOops: 0000 [#1] PREEMPT SMP NOPTI\nRIP: 0010:complete_all+0x3e/0xa0\n[...]\nCall Trace:\n <TASK>\n ? __die_body+0x68/0xb0\n ? page_fault_oops+0x379/0x3e0\n ? exc_page_fault+0x69/0xa0\n ? asm_exc_page_fault+0x22/0x30\n ? complete_all+0x3e/0xa0\n fsm_main_thread+0xa3/0x9c0 [mtk_t7xx (HASH:1400 5)]\n ? __pfx_autoremove_wake_function+0x10/0x10\n kthread+0xd8/0x110\n ? __pfx_fsm_main_thread+0x10/0x10 [mtk_t7xx (HASH:1400 5)]\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x38/0x50\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1b/0x30\n </TASK>\n[...]\nCR2: fffffffffffffff8\n---[ end trace 0000000000000000 ]---\n\nUse the reference counter to ensure safe release as Sergey suggests:\nhttps://lore.kernel.org/all/da90f64c-260a-4329-87bf-1f9ff20a5951@gmail.com/"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable `t7xx_fsm_append_cmd()` wait is entered only through host-local operations \u2014 the root-writable `t7xx_mode` sysfs reset attribute, PCI unbind/shutdown via `t7xx_md_exit()`, and runtime/system PM resume (`__t7xx_pci_pm_resume()`) driven by local packet transmission on the WWAN netdev. No remote peer data reaches the FSM command queue; the dpmaif RX packet path never touches this code.\nAC:L - The attacker controls both sides of the race \u2014 repeatedly driving device reset/resume queues an FSM_CMD_STOP/PRE_STOP behind an FSM thread that is deterministically stalled far past the 2000 ms `FSM_CMD_TIMEOUT_MS` (20 s in `wait_for_expected_dev_stage()` during modem reboot, 10 s + 45 s in `fsm_routine_exception()`), and the attempt can be retried indefinitely.\nPR:L - An unprivileged local user reaches the vulnerable wait via runtime PM: the modem autosuspends after `PM_AUTOSUSPEND_MS`, and any packet sent over the WWAN interface makes `t7xx_dpmaif_tx_hw_push_thread()`/NAPI call `pm_runtime_resume_and_get()`, entering `__t7xx_pci_pm_resume()` which issues `t7xx_send_fsm_command(FSM_CMD_STOP)` and `t7xx_pci_reprobe_early()`. No capability check gates that path.\nUI:N - The attacker performs the triggering reset/resume and the concurrent traffic itself; no victim must mount, open, or interact with anything.\nS:U - The stale-stack write and waitqueue walk corrupt kernel memory within the same host kernel security authority, with no hypervisor, IOMMU, or sandbox boundary crossed.\nC:H - `complete_all(cmd->done)` operates on a recycled kernel stack whose contents the attacker shapes with subsequent syscalls, so a crafted `struct completion` yields a controlled `swake_up_all_locked()` list walk and `curr->task` dereference \u2014 memory corruption leverageable for arbitrary kernel reads, matching the guidance that use-after-free-class corruption is High.\nI:H - The bug gives two write primitives into freed stack memory \u2014 `*cmd->ret = result` and `x->done = UINT_MAX` plus the `list_del()` unlink inside `swake_up_all_locked()` \u2014 and a controlled `list_del` over attacker-planted `next`/`prev` pointers is a classic arbitrary-write and control-flow-hijack primitive.\nA:H - The commit message documents the concrete result: an unrecoverable page fault at `fffffffffffffff8` in `complete_all()` from `fsm_main_thread`, an oops that kills the FSM kthread and panics the kernel."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wwan/t7xx/t7xx_state_monitor.c", "drivers/net/wwan/t7xx/t7xx_state_monitor.h"], "versions": [{"version": "13e920d93e37fcaef4a9309515798a3cae9dcf19", "lessThan": "b8ab9bd0c8855cd5a6f4e0265083576257ff3fc5", "status": "affected", "versionType": "git"}, {"version": "13e920d93e37fcaef4a9309515798a3cae9dcf19", "lessThan": "0cd3bde081cd3452c875fa1e5c55834c670d6e05", "status": "affected", "versionType": "git"}, {"version": "13e920d93e37fcaef4a9309515798a3cae9dcf19", "lessThan": "e6e6882a1590cbdaca77a31a02f4954327237e14", "status": "affected", "versionType": "git"}, {"version": "13e920d93e37fcaef4a9309515798a3cae9dcf19", "lessThan": "4f619d518db9cd1a933c3a095a5f95d0c1584ae8", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wwan/t7xx/t7xx_state_monitor.c", "drivers/net/wwan/t7xx/t7xx_state_monitor.h"], "versions": [{"version": "5.19", "status": "affected"}, {"version": "0", "lessThan": "5.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.124", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.70", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.9", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.1.124"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.6.70"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.12.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.13"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b8ab9bd0c8855cd5a6f4e0265083576257ff3fc5"}, {"url": "https://git.kernel.org/stable/c/0cd3bde081cd3452c875fa1e5c55834c670d6e05"}, {"url": "https://git.kernel.org/stable/c/e6e6882a1590cbdaca77a31a02f4954327237e14"}, {"url": "https://git.kernel.org/stable/c/4f619d518db9cd1a933c3a095a5f95d0c1584ae8"}], "title": "net: wwan: t7xx: Fix FSM command timeout issue", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:38:14.199Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/wwan/t7xx/t7xx_state_monitor.c", "drivers/net/wwan/t7xx/t7xx_state_monitor.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b8ab9bd0c8855cd5a6f4e0265083576257ff3fc5", "status": "affected", "version": "13e920d93e37fcaef4a9309515798a3cae9dcf19", "versionType": "git"}, {"lessThan": "0cd3bde081cd3452c875fa1e5c55834c670d6e05", "status": "affected", "version": "13e920d93e37fcaef4a9309515798a3cae9dcf19", "versionType": "git"}, {"lessThan": "e6e6882a1590cbdaca77a31a02f4954327237e14", "status": "affected", "version": "13e920d93e37fcaef4a9309515798a3cae9dcf19", "versionType": "git"}, {"lessThan": "4f619d518db9cd1a933c3a095a5f95d0c1584ae8", "status": "affected", "version": "13e920d93e37fcaef4a9309515798a3cae9dcf19", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/wwan/t7xx/t7xx_state_monitor.c", "drivers/net/wwan/t7xx/t7xx_state_monitor.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.19"}, {"lessThan": "5.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.124", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.70", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.13", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F5BFFB6C-08E3-4EDC-8F12-6B86C072E0A9", "versionEndExcluding": "6.1.124", "versionStartIncluding": "5.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "51E6CFF2-92AA-4936-95AB-2D068168A696", "versionEndExcluding": "6.6.70", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1D13AF97-FFED-4B68-906D-CFE38D0B88DD", "versionEndExcluding": "6.12.9", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*", "matchCriteriaId": "62567B3C-6CEE-46D0-BC2E-B3717FBF7D13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*", "matchCriteriaId": "5A073481-106D-4B15-B4C7-FB0213B8E1D4", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*", "matchCriteriaId": "DE491969-75AE-4A6B-9A58-8FC5AF98798F", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*", "matchCriteriaId": "93C0660D-7FB8-4FBA-892A-B064BA71E49E", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*", "matchCriteriaId": "034C36A6-C481-41F3-AE9A-D116E5BE6895", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: wwan: t7xx: Fix FSM command timeout issue\n\nWhen driver processes the internal state change command, it use an\nasynchronous thread to process the command operation. If the main\nthread detects that the task has timed out, the asynchronous thread\nwill panic when executing the completion notification because the\nmain thread completion object has been released.\n\nBUG: unable to handle page fault for address: fffffffffffffff8\nPGD 1f283a067 P4D 1f283a067 PUD 1f283c067 PMD 0\nOops: 0000 [#1] PREEMPT SMP NOPTI\nRIP: 0010:complete_all+0x3e/0xa0\n[...]\nCall Trace:\n <TASK>\n ? __die_body+0x68/0xb0\n ? page_fault_oops+0x379/0x3e0\n ? exc_page_fault+0x69/0xa0\n ? asm_exc_page_fault+0x22/0x30\n ? complete_all+0x3e/0xa0\n fsm_main_thread+0xa3/0x9c0 [mtk_t7xx (HASH:1400 5)]\n ? __pfx_autoremove_wake_function+0x10/0x10\n kthread+0xd8/0x110\n ? __pfx_fsm_main_thread+0x10/0x10 [mtk_t7xx (HASH:1400 5)]\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x38/0x50\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1b/0x30\n </TASK>\n[...]\nCR2: fffffffffffffff8\n---[ end trace 0000000000000000 ]---\n\nUse the reference counter to ensure safe release as Sergey suggests:\nhttps://lore.kernel.org/all/da90f64c-260a-4329-87bf-1f9ff20a5951@gmail.com/"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: wwan: t7xx: Soluci\u00f3n del problema de tiempo de espera del comando FSM Cuando el controlador procesa el comando de cambio de estado interno, utiliza un hilo asincr\u00f3nico para procesar la operaci\u00f3n del comando. Si el hilo principal detecta que se agot\u00f3 el tiempo de espera de la tarea, el hilo asincr\u00f3nico entrar\u00e1 en p\u00e1nico al ejecutar la notificaci\u00f3n de finalizaci\u00f3n porque se liber\u00f3 el objeto de finalizaci\u00f3n del hilo principal. ERROR: no se puede gestionar el error de p\u00e1gina para la direcci\u00f3n: fffffffffffffff8 PGD 1f283a067 P4D 1f283a067 PUD 1f283c067 PMD 0 Oops: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:complete_all+0x3e/0xa0 [...] Seguimiento de llamadas: ? __die_body+0x68/0xb0 ? page_fault_oops+0x379/0x3e0 ? exc_page_fault+0x69/0xa0 ? asm_exc_page_fault+0x22/0x30 ? complete_all+0x3e/0xa0 fsm_main_thread+0xa3/0x9c0 [mtk_t7xx (HASH:1400 5)] ? __pfx_autoremove_wake_function+0x10/0x10 kthread+0xd8/0x110 ? __pfx_fsm_main_thread+0x10/0x10 [mtk_t7xx (HASH:1400 5)] ? __pfx_kthread+0x10/0x10 ret_from_fork+0x38/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 [...] CR2: fffffffffffffff8 ---[ fin del seguimiento 000000000000000 ]--- Utilice el contador de referencia para garantizar una liberaci\u00f3n segura como sugiere Sergey: https://lore.kernel.org/all/da90f64c-260a-4329-87bf-1f9ff20a5951@gmail.com/"}], "id": "CVE-2024-39282", "lastModified": "2026-08-04T11:18:55.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-01-15T13:15:09.740", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0cd3bde081cd3452c875fa1e5c55834c670d6e05"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4f619d518db9cd1a933c3a095a5f95d0c1584ae8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b8ab9bd0c8855cd5a6f4e0265083576257ff3fc5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e6e6882a1590cbdaca77a31a02f4954327237e14"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: net: wwan: t7xx: Fix FSM command timeout issue", "id": "2338191", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2338191"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: wwan: t7xx: Fix FSM command timeout issue\nWhen driver processes the internal state change command, it use an\nasynchronous thread to process the command operation. If the main\nthread detects that the task has timed out, the asynchronous thread\nwill panic when executing the completion notification because the\nmain thread completion object has been released.\nBUG: unable to handle page fault for address: fffffffffffffff8\nPGD 1f283a067 P4D 1f283a067 PUD 1f283c067 PMD 0\nOops: 0000 [#1] PREEMPT SMP NOPTI\nRIP: 0010:complete_all+0x3e/0xa0\n[...]\nCall Trace:\n<TASK>\n? __die_body+0x68/0xb0\n? page_fault_oops+0x379/0x3e0\n? exc_page_fault+0x69/0xa0\n? asm_exc_page_fault+0x22/0x30\n? complete_all+0x3e/0xa0\nfsm_main_thread+0xa3/0x9c0 [mtk_t7xx (HASH:1400 5)]\n? __pfx_autoremove_wake_function+0x10/0x10\nkthread+0xd8/0x110\n? __pfx_fsm_main_thread+0x10/0x10 [mtk_t7xx (HASH:1400 5)]\n? __pfx_kthread+0x10/0x10\nret_from_fork+0x38/0x50\n? __pfx_kthread+0x10/0x10\nret_from_fork_asm+0x1b/0x30\n</TASK>\n[...]\nCR2: fffffffffffffff8\n---[ end trace 0000000000000000 ]---\nUse the reference counter to ensure safe release as Sergey suggests:\nhttps://lore.kernel.org/all/da90f64c-260a-4329-87bf-1f9ff20a5951@gmail.com/"], "name": "CVE-2024-39282", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-01-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-39282\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-39282\nhttps://lore.kernel.org/linux-cve-announce/2025011532-CVE-2024-39282-491b@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-07-13T11:14:56.728937+00:00", "updated": "2025-07-13T11:14:56.729024+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}