Debian: CVE-2024-38575: linux -- security update

Debian: CVE-2024-38575: linux -- security update

Severity

4

CVSS

(AV:L/AC:M/Au:N/C:P/I:P/A:P)

Published

06/19/2024

Created

07/31/2024

Added

07/30/2024

Modified

02/03/2025

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: pcie: handle randbuf allocation failure The kzalloc() in brcmf_pcie_download_fw_nvram() will return null if the physical memory has run out. As a result, if we use get_random_bytes() to generate random bytes in the randbuf, the null pointer dereference bug will happen. In order to prevent allocation failure, this patch adds a separate function using buffer on kernel stack to generate random bytes in the randbuf, which could prevent the kernel stack from overflow.

Solution(s)

• debian-upgrade-linux

References

• https://attackerkb.com/topics/cve-2024-38575
• CVE - 2024-38575