CVE-2024-43830

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-43830", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-08-17T09:11:59.273Z", "datePublished": "2024-08-17T09:21:48.946Z", "dateUpdated": "2026-10-15T00:48:25.048Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:36:40.589Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nleds: trigger: Unregister sysfs attributes before calling deactivate()\n\nTriggers which have trigger specific sysfs attributes typically store\nrelated data in trigger-data allocated by the activate() callback and\nfreed by the deactivate() callback.\n\nCalling device_remove_groups() after calling deactivate() leaves a window\nwhere the sysfs attributes show/store functions could be called after\ndeactivation and then operate on the just freed trigger-data.\n\nMove the device_remove_groups() call to before deactivate() to close\nthis race window.\n\nThis also makes the deactivation path properly do things in reverse order\nof the activation path which calls the activate() callback before calling\ndevice_add_groups()."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached only through local interfaces \u2014 sysfs writes/reads under /sys/class/leds/<led>/ and the v4l2 subdev/flash device nodes that call led_trigger_remove(). No network, adjacent-network, or physical-attach path reaches led_trigger_set().\nAC:L - The attacker drives both sides of the race from two of their own threads, and the window is not instruction-tight: ttyname_store()/ttyname_show() sleep for up to hundreds of milliseconds inside wait_for_completion_timeout() on the trigger data while the concurrent trigger change calls deactivate() and frees it, with no lock or kernfs drain in between. Attempts are unlimited and free, so the UAF can be hit reliably.\nPR:L - The racing sysfs attribute show/store callbacks that touch the freed trigger data are world-readable (0644), and the deactivation side is reachable by an unprivileged local user through v4l2_flash_open()/privacy-LED handling on a camera subdev node, or on Android/embedded systems where /sys/class/leds/*/trigger is chowned to a non-root service UID. No real root in the init namespace is required.\nUI:N - The attacker performs both the trigger change and the concurrent attribute access from their own threads; no victim action or interaction is needed.\nS:U - The use-after-free corrupts kernel slab memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The show callbacks read the freed trigger_data \u2014 e.g. ttyname_show() sprintf()s a dangling char * to a user buffer and netdev's device_name_show()/interval_show() copy out freed-slab contents \u2014 giving a groomable kernel heap information leak.\nI:H - Store callbacks write into the freed object (reinit_completion(), trigger_data->ttyname = ..., atomic_set of interval, mode bit sets) and then act on attacker-groomable pointers via kfree(trigger_data->ttyname), tty_kref_put(trigger_data->tty), and schedule_delayed_work() on a freed delayed_work \u2014 arbitrary free, refcount decrement, and work-function-pointer control suitable for privilege escalation.\nA:H - Operating on freed trigger data corrupts the slab, the workqueue/timer lists, and the completion wait queue, reliably producing a kernel oops or panic that the attacker can trigger repeatedly."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/leds/led-triggers.c"], "versions": [{"version": "a7e7a3156300a7e1982b03cc9cb8fb0c86434c49", "lessThan": "c3b7a650c8717aa89df318364609c86cbc040156", "status": "affected", "versionType": "git"}, {"version": "a7e7a3156300a7e1982b03cc9cb8fb0c86434c49", "lessThan": "d1415125b701ef13370e2761f691ec632a5eb93a", "status": "affected", "versionType": "git"}, {"version": "a7e7a3156300a7e1982b03cc9cb8fb0c86434c49", "lessThan": "09c1583f0e10c918855d6e7540a79461a353e5d6", "status": "affected", "versionType": "git"}, {"version": "a7e7a3156300a7e1982b03cc9cb8fb0c86434c49", "lessThan": "3fb6a9d67cfd812a547ac73ec02e1077c26c640d", "status": "affected", "versionType": "git"}, {"version": "a7e7a3156300a7e1982b03cc9cb8fb0c86434c49", "lessThan": "734ba6437e80dfc780e9ee9d95f912392d12b5ea", "status": "affected", "versionType": "git"}, {"version": "a7e7a3156300a7e1982b03cc9cb8fb0c86434c49", "lessThan": "cb8aa9d2a4c8a15d6a43ccf901ef3d094aa60374", "status": "affected", "versionType": "git"}, {"version": "a7e7a3156300a7e1982b03cc9cb8fb0c86434c49", "lessThan": "0788a6f3523d3686a9eed5ea1e6fcce6841277b2", "status": "affected", "versionType": "git"}, {"version": "a7e7a3156300a7e1982b03cc9cb8fb0c86434c49", "lessThan": "c0dc9adf9474ecb7106e60e5472577375aedaed3", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/leds/led-triggers.c"], "versions": [{"version": "4.19", "status": "affected"}, {"version": "0", "lessThan": "4.19", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.320", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.282", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.224", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.165", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.103", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.44", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10.3", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "4.19.320"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.4.282"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.10.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.15.165"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.1.103"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.6.44"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.10.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.11"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c3b7a650c8717aa89df318364609c86cbc040156"}, {"url": "https://git.kernel.org/stable/c/d1415125b701ef13370e2761f691ec632a5eb93a"}, {"url": "https://git.kernel.org/stable/c/09c1583f0e10c918855d6e7540a79461a353e5d6"}, {"url": "https://git.kernel.org/stable/c/3fb6a9d67cfd812a547ac73ec02e1077c26c640d"}, {"url": "https://git.kernel.org/stable/c/734ba6437e80dfc780e9ee9d95f912392d12b5ea"}, {"url": "https://git.kernel.org/stable/c/cb8aa9d2a4c8a15d6a43ccf901ef3d094aa60374"}, {"url": "https://git.kernel.org/stable/c/0788a6f3523d3686a9eed5ea1e6fcce6841277b2"}, {"url": "https://git.kernel.org/stable/c/c0dc9adf9474ecb7106e60e5472577375aedaed3"}], "title": "leds: trigger: Unregister sysfs attributes before calling deactivate()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-43830", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:08:31.513833Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-12T17:33:23.792Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:05:15.405Z"}}, {"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T00:48:25.048Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.1.1", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:05:15.405Z"}}, {"affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.1.1", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T00:48:25.048Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-43830", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:08:31.513833Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:23.154Z"}}], "cna": {"title": "leds: trigger: Unregister sysfs attributes before calling deactivate()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached only through local interfaces \u2014 sysfs writes/reads under /sys/class/leds/<led>/ and the v4l2 subdev/flash device nodes that call led_trigger_remove(). No network, adjacent-network, or physical-attach path reaches led_trigger_set().\nAC:L - The attacker drives both sides of the race from two of their own threads, and the window is not instruction-tight: ttyname_store()/ttyname_show() sleep for up to hundreds of milliseconds inside wait_for_completion_timeout() on the trigger data while the concurrent trigger change calls deactivate() and frees it, with no lock or kernfs drain in between. Attempts are unlimited and free, so the UAF can be hit reliably.\nPR:L - The racing sysfs attribute show/store callbacks that touch the freed trigger data are world-readable (0644), and the deactivation side is reachable by an unprivileged local user through v4l2_flash_open()/privacy-LED handling on a camera subdev node, or on Android/embedded systems where /sys/class/leds/*/trigger is chowned to a non-root service UID. No real root in the init namespace is required.\nUI:N - The attacker performs both the trigger change and the concurrent attribute access from their own threads; no victim action or interaction is needed.\nS:U - The use-after-free corrupts kernel slab memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The show callbacks read the freed trigger_data \u2014 e.g. ttyname_show() sprintf()s a dangling char * to a user buffer and netdev's device_name_show()/interval_show() copy out freed-slab contents \u2014 giving a groomable kernel heap information leak.\nI:H - Store callbacks write into the freed object (reinit_completion(), trigger_data->ttyname = ..., atomic_set of interval, mode bit sets) and then act on attacker-groomable pointers via kfree(trigger_data->ttyname), tty_kref_put(trigger_data->tty), and schedule_delayed_work() on a freed delayed_work \u2014 arbitrary free, refcount decrement, and work-function-pointer control suitable for privilege escalation.\nA:H - Operating on freed trigger data corrupts the slab, the workqueue/timer lists, and the completion wait queue, reliably producing a kernel oops or panic that the attacker can trigger repeatedly."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "a7e7a3156300a7e1982b03cc9cb8fb0c86434c49", "lessThan": "c3b7a650c8717aa89df318364609c86cbc040156", "versionType": "git"}, {"status": "affected", "version": "a7e7a3156300a7e1982b03cc9cb8fb0c86434c49", "lessThan": "d1415125b701ef13370e2761f691ec632a5eb93a", "versionType": "git"}, {"status": "affected", "version": "a7e7a3156300a7e1982b03cc9cb8fb0c86434c49", "lessThan": "09c1583f0e10c918855d6e7540a79461a353e5d6", "versionType": "git"}, {"status": "affected", "version": "a7e7a3156300a7e1982b03cc9cb8fb0c86434c49", "lessThan": "3fb6a9d67cfd812a547ac73ec02e1077c26c640d", "versionType": "git"}, {"status": "affected", "version": "a7e7a3156300a7e1982b03cc9cb8fb0c86434c49", "lessThan": "734ba6437e80dfc780e9ee9d95f912392d12b5ea", "versionType": "git"}, {"status": "affected", "version": "a7e7a3156300a7e1982b03cc9cb8fb0c86434c49", "lessThan": "cb8aa9d2a4c8a15d6a43ccf901ef3d094aa60374", "versionType": "git"}, {"status": "affected", "version": "a7e7a3156300a7e1982b03cc9cb8fb0c86434c49", "lessThan": "0788a6f3523d3686a9eed5ea1e6fcce6841277b2", "versionType": "git"}, {"status": "affected", "version": "a7e7a3156300a7e1982b03cc9cb8fb0c86434c49", "lessThan": "c0dc9adf9474ecb7106e60e5472577375aedaed3", "versionType": "git"}], "programFiles": ["drivers/leds/led-triggers.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.19"}, {"status": "unaffected", "version": "0", "lessThan": "4.19", "versionType": "semver"}, {"status": "unaffected", "version": "4.19.320", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.282", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.224", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.165", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.103", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.44", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.10.3", "versionType": "semver", "lessThanOrEqual": "6.10.*"}, {"status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/leds/led-triggers.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/c3b7a650c8717aa89df318364609c86cbc040156"}, {"url": "https://git.kernel.org/stable/c/d1415125b701ef13370e2761f691ec632a5eb93a"}, {"url": "https://git.kernel.org/stable/c/09c1583f0e10c918855d6e7540a79461a353e5d6"}, {"url": "https://git.kernel.org/stable/c/3fb6a9d67cfd812a547ac73ec02e1077c26c640d"}, {"url": "https://git.kernel.org/stable/c/734ba6437e80dfc780e9ee9d95f912392d12b5ea"}, {"url": "https://git.kernel.org/stable/c/cb8aa9d2a4c8a15d6a43ccf901ef3d094aa60374"}, {"url": "https://git.kernel.org/stable/c/0788a6f3523d3686a9eed5ea1e6fcce6841277b2"}, {"url": "https://git.kernel.org/stable/c/c0dc9adf9474ecb7106e60e5472577375aedaed3"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nleds: trigger: Unregister sysfs attributes before calling deactivate()\n\nTriggers which have trigger specific sysfs attributes typically store\nrelated data in trigger-data allocated by the activate() callback and\nfreed by the deactivate() callback.\n\nCalling device_remove_groups() after calling deactivate() leaves a window\nwhere the sysfs attributes show/store functions could be called after\ndeactivation and then operate on the just freed trigger-data.\n\nMove the device_remove_groups() call to before deactivate() to close\nthis race window.\n\nThis also makes the deactivation path properly do things in reverse order\nof the activation path which calls the activate() callback before calling\ndevice_add_groups()."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.320", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.282", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.224", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.165", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.103", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.44", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10.3", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.11", "versionStartIncluding": "4.19"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:36:40.589Z"}}}, "cveMetadata": {"cveId": "CVE-2024-43830", "state": "PUBLISHED", "dateUpdated": "2026-10-15T00:48:25.048Z", "dateReserved": "2024-08-17T09:11:59.273Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-08-17T09:21:48.946Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/leds/led-triggers.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c3b7a650c8717aa89df318364609c86cbc040156", "status": "affected", "version": "a7e7a3156300a7e1982b03cc9cb8fb0c86434c49", "versionType": "git"}, {"lessThan": "d1415125b701ef13370e2761f691ec632a5eb93a", "status": "affected", "version": "a7e7a3156300a7e1982b03cc9cb8fb0c86434c49", "versionType": "git"}, {"lessThan": "09c1583f0e10c918855d6e7540a79461a353e5d6", "status": "affected", "version": "a7e7a3156300a7e1982b03cc9cb8fb0c86434c49", "versionType": "git"}, {"lessThan": "3fb6a9d67cfd812a547ac73ec02e1077c26c640d", "status": "affected", "version": "a7e7a3156300a7e1982b03cc9cb8fb0c86434c49", "versionType": "git"}, {"lessThan": "734ba6437e80dfc780e9ee9d95f912392d12b5ea", "status": "affected", "version": "a7e7a3156300a7e1982b03cc9cb8fb0c86434c49", "versionType": "git"}, {"lessThan": "cb8aa9d2a4c8a15d6a43ccf901ef3d094aa60374", "status": "affected", "version": "a7e7a3156300a7e1982b03cc9cb8fb0c86434c49", "versionType": "git"}, {"lessThan": "0788a6f3523d3686a9eed5ea1e6fcce6841277b2", "status": "affected", "version": "a7e7a3156300a7e1982b03cc9cb8fb0c86434c49", "versionType": "git"}, {"lessThan": "c0dc9adf9474ecb7106e60e5472577375aedaed3", "status": "affected", "version": "a7e7a3156300a7e1982b03cc9cb8fb0c86434c49", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/leds/led-triggers.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.19"}, {"lessThan": "4.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.320", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.282", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.224", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver"}, {"lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "V1.1.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E8BAB0DE-BD14-4697-AE2B-C241BA82016C", "versionEndExcluding": "4.19.320", "versionStartIncluding": "4.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A8961D98-9ACF-4188-BA88-44038B14BC28", "versionEndExcluding": "5.4.282", "versionStartIncluding": "4.20", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5CCEDF13-293D-4E64-B501-4409D0365AFE", "versionEndExcluding": "5.10.224", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B4E2B568-3171-41DE-B519-F2B1A3600D94", "versionEndExcluding": "5.15.165", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E45EAC72-8329-4F99-8276-86AF9BB3496A", "versionEndExcluding": "6.1.103", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "CC912330-6B41-4C6B-99AF-F3857FBACB6A", "versionEndExcluding": "6.6.44", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "92D388F2-1EAF-4CFA-AC06-5B26D762EA7D", "versionEndExcluding": "6.10.3", "versionStartIncluding": "6.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nleds: trigger: Unregister sysfs attributes before calling deactivate()\n\nTriggers which have trigger specific sysfs attributes typically store\nrelated data in trigger-data allocated by the activate() callback and\nfreed by the deactivate() callback.\n\nCalling device_remove_groups() after calling deactivate() leaves a window\nwhere the sysfs attributes show/store functions could be called after\ndeactivation and then operate on the just freed trigger-data.\n\nMove the device_remove_groups() call to before deactivate() to close\nthis race window.\n\nThis also makes the deactivation path properly do things in reverse order\nof the activation path which calls the activate() callback before calling\ndevice_add_groups()."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: leds: trigger: Anular el registro de los atributos sysfs antes de llamar a desactivar() Los activadores que tienen atributos sysfs espec\u00edficos del activador normalmente almacenan datos relacionados en datos de activaci\u00f3n asignados por la devoluci\u00f3n de llamada enable() y liberados por el desactivar() devoluci\u00f3n de llamada. Llamar a device_remove_groups() despu\u00e9s de llamar a deactivate() deja una ventana donde los atributos sysfs muestran/almacenan funciones que se pueden llamar despu\u00e9s de la desactivaci\u00f3n y luego operar con los datos de activaci\u00f3n reci\u00e9n liberados. Mueva la llamada device_remove_groups() antes de desactivar() para cerrar esta ventana de ejecuci\u00f3n. Esto tambi\u00e9n hace que la ruta de desactivaci\u00f3n haga las cosas correctamente en orden inverso a la ruta de activaci\u00f3n que llama a la devoluci\u00f3n de llamada enable() antes de llamar a device_add_groups()."}], "id": "CVE-2024-43830", "lastModified": "2026-10-15T01:18:47.510", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-43830", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:08:31.513833Z", "version": "2.0.3"}}]}, "published": "2024-08-17T10:15:08.857", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0788a6f3523d3686a9eed5ea1e6fcce6841277b2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/09c1583f0e10c918855d6e7540a79461a353e5d6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3fb6a9d67cfd812a547ac73ec02e1077c26c640d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/734ba6437e80dfc780e9ee9d95f912392d12b5ea"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c0dc9adf9474ecb7106e60e5472577375aedaed3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c3b7a650c8717aa89df318364609c86cbc040156"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cb8aa9d2a4c8a15d6a43ccf901ef3d094aa60374"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d1415125b701ef13370e2761f691ec632a5eb93a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2024:7000", "cpe": "cpe:/o:redhat:enterprise_linux:8", "package": "kernel-0:4.18.0-553.22.1.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-09-24T00:00:00Z"}, {"advisory": "RHSA-2024:9315", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.11.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-11-12T00:00:00Z"}, {"advisory": "RHSA-2024:9315", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.11.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-11-12T00:00:00Z"}, {"advisory": "RHSA-2025:2490", "cpe": "cpe:/a:redhat:rhel_eus:9.4", "package": "kernel-0:5.14.0-427.59.1.el9_4", "product_name": "Red Hat Enterprise Linux 9.4 Extended Update Support", "release_date": "2025-03-10T00:00:00Z"}], "bugzilla": {"description": "kernel: leds: trigger: Unregister sysfs attributes before calling deactivate()", "id": "2305488", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2305488"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.6", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H", "status": "verified"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nleds: trigger: Unregister sysfs attributes before calling deactivate()\nTriggers which have trigger specific sysfs attributes typically store\nrelated data in trigger-data allocated by the activate() callback and\nfreed by the deactivate() callback.\nCalling device_remove_groups() after calling deactivate() leaves a window\nwhere the sysfs attributes show/store functions could be called after\ndeactivation and then operate on the just freed trigger-data.\nMove the device_remove_groups() call to before deactivate() to close\nthis race window.\nThis also makes the deactivation path properly do things in reverse order\nof the activation path which calls the activate() callback before calling\ndevice_add_groups()."], "name": "CVE-2024-43830", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-08-17T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-43830\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-43830\nhttps://lore.kernel.org/linux-cve-announce/2024081727-CVE-2024-43830-3b85@gregkh/T"], "threat_severity": "Moderate"}

{}