PT-2024-5437 · Linux+2 · Linux Kernel+2

Jia Jie Ho · Published 2024-05-10 · Updated 2026-01-08 · CVE-2024-39478

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to the crypto starfive module in the Linux kernel, where a variable length buffer allocated in the software stack for RSA text data is freed, causing undefined behavior in subsequent operations. This is due to the function starfive rsa enc core() in the module drivers/crypto/starfive/jh7110-rsa.c, which is associated with the reuse of previously freed memory. Exploitation of this issue may allow an attacker to impact the availability of protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

AZL-62618

BDU:2024-06086

CVE-2024-39478

OESA-2024-1863

USN-6999-1

USN-6999-2

USN-7004-1

USN-7005-1

USN-7005-2

USN-7008-1

USN-7029-1

Affected Products

Linuxmint

Linux Kernel

Ubuntu

References · 301

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39478.json · Exploit
• https://ubuntu.com/security/CVE-2024-40957 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7004-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-40984 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6999-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6999-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-40973 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-39488 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-41002 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-40906 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-38628 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-34027 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7004-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-39487 · Security Note
• https://ubuntu.com/security/CVE-2024-23848 · Vendor Advisory