CVE-2024-53213

Summary

CVE-2024-53213 is a vulnerability affecting the Linux kernel's lan78xx driver. In the function lan78xx_probe(), a double free issue was identified with the implicit freeing of the buffer 'buf' through usb_free_urb() with the URB_FREE_BUFFER flag and an explicit freeing of buf using kfree(). This led to a double free scenario. The issue has been resolved by reordering the kmalloc() and usb_alloc_urb() calls and eliminating the redundant kfree(buf) call. Now, buf is allocated following usb_alloc_urb() and managed correctly by usb_fill_int_urb() and freed appropriately by usb_free_urb().

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.