{"vulnerability": "CVE-2024-4388", "sightings": [{"uuid": "c4e904a2-cf40-4a78-9bef-a5f8c32b0439", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-43880", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07", "content": "", "creation_timestamp": "2025-08-14T10:00:00.000000Z"}, {"uuid": "ad2984bc-9d5c-4ed2-976d-0a2c95406046", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-43883", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07", "content": "", "creation_timestamp": "2025-08-14T10:00:00.000000Z"}, {"uuid": "1d7e1978-bdb2-4ff6-aaad-be2b82f83132", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-43889", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07", "content": "", "creation_timestamp": "2025-08-14T10:00:00.000000Z"}, {"uuid": "537dff1c-15b2-4171-adc6-3116f3a9c322", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-43882", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07", "content": "", "creation_timestamp": "2025-08-14T10:00:00.000000Z"}, {"uuid": "b2441b4a-fd71-4509-b235-ae374011094a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-43883", "type": "seen", "source": "https://t.me/cvedetector/3983", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-43883 - Oracle Linux Kernel Double-Free Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-43883 \nPublished : Aug. 23, 2024, 1:15 p.m. | 43\u00a0minutes ago \nDescription : In the Linux kernel, the following vulnerability has been resolved:  \n  \nusb: vhci-hcd: Do not drop references before new references are gained  \n  \nAt a few places the driver carries stale pointers  \nto references that can still be used. Make sure that does not happen.  \nThis strictly speaking closes ZDI-CAN-22273, though there may be  \nsimilar races in the driver. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"23 Aug 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-08-23T16:17:39.000000Z"}, {"uuid": "7c370e06-e8ee-4227-bde2-be99568dad6a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-43880", "type": "seen", "source": "https://t.me/cvedetector/3707", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-43880 - Mellanox Technologies MSN3700C MLXSw Object Nesting Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-43880 \nPublished : Aug. 21, 2024, 1:15 a.m. | 37\u00a0minutes ago \nDescription : In the Linux kernel, the following vulnerability has been resolved:  \n  \nmlxsw: spectrum_acl_erp: Fix object nesting warning  \n  \nACLs in Spectrum-2 and newer ASICs can reside in the algorithmic TCAM  \n(A-TCAM) or in the ordinary circuit TCAM (C-TCAM). The former can  \ncontain more ACLs (i.e., tc filters), but the number of masks in each  \nregion (i.e., tc chain) is limited.  \n  \nIn order to mitigate the effects of the above limitation, the device  \nallows filters to share a single mask if their masks only differ in up  \nto 8 consecutive bits. For example, dst_ip/25 can be represented using  \ndst_ip/24 with a delta of 1 bit. The C-TCAM does not have a limit on the  \nnumber of masks being used (and therefore does not support mask  \naggregation), but can contain a limited number of filters.  \n  \nThe driver uses the \"objagg\" library to perform the mask aggregation by  \npassing it objects that consist of the filter's mask and whether the  \nfilter is to be inserted into the A-TCAM or the C-TCAM since filters in  \ndifferent TCAMs cannot share a mask.  \n  \nThe set of created objects is dependent on the insertion order of the  \nfilters and is not necessarily optimal. Therefore, the driver will  \nperiodically ask the library to compute a more optimal set (\"hints\") by  \nlooking at all the existing objects.  \n  \nWhen the library asks the driver whether two objects can be aggregated  \nthe driver only compares the provided masks and ignores the A-TCAM /  \nC-TCAM indication. This is the right thing to do since the goal is to  \nmove as many filters as possible to the A-TCAM. The driver also forbids  \ntwo identical masks from being aggregated since this can only happen if  \none was intentionally put in the C-TCAM to avoid a conflict in the  \nA-TCAM.  \n  \nThe above can result in the following set of hints:  \n  \nH1: {mask X, A-TCAM} -> H2: {mask Y, A-TCAM} // X is Y + delta  \nH3: {mask Y, C-TCAM} -> H4: {mask Z, A-TCAM} // Y is Z + delta  \n  \nAfter getting the hints from the library the driver will start migrating  \nfilters from one region to another while consulting the computed hints  \nand instructing the device to perform a lookup in both regions during  \nthe transition.  \n  \nAssuming a filter with mask X is being migrated into the A-TCAM in the  \nnew region, the hints lookup will return H1. Since H2 is the parent of  \nH1, the library will try to find the object associated with it and  \ncreate it if necessary in which case another hints lookup (recursive)  \nwill be performed. This hints lookup for {mask Y, A-TCAM} will either  \nreturn H2 or H3 since the driver passes the library an object comparison  \nfunction that ignores the A-TCAM / C-TCAM indication.  \n  \nThis can eventually lead to nested objects which are not supported by  \nthe library [1].  \n  \nFix by removing the object comparison function from both the driver and  \nthe library as the driver was the only user. That way the lookup will  \nonly return exact matches.  \n  \nI do not have a reliable reproducer that can reproduce the issue in a  \ntimely manner, but before the fix the issue would reproduce in several  \nminutes and with the fix it does not reproduce in over an hour.  \n  \nNote that the current usefulness of the hints is limited because they  \ninclude the C-TCAM indication and represent aggregation that cannot  \nactually happen. This will be addressed in net-next.  \n  \n[1]  \nWARNING: CPU: 0 PID: 153 at lib/objagg.c:170 objagg_obj_parent_assign+0xb5/0xd0  \nModules linked in:  \nCPU: 0 PID: 153 Comm: kworker/0:18 Not tainted 6.9.0-rc6-custom-g70fbc2c1c38b #42  \nHardware name: Mellanox Technologies Ltd. MSN3700C/VMOD0008, BIOS 5.11 10/10/2018  \nWorkqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work  \nRIP: 0010:objagg_obj_parent_assign+0xb5/0xd0  \n[...]  \nCall Trace:  \n   \n __objagg_obj_get+0x2bb/0[...]", "creation_timestamp": "2024-08-21T04:00:31.000000Z"}, {"uuid": "df290cac-ca53-498f-b3ca-71f3246ca48f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-43882", "type": "seen", "source": "https://t.me/cvedetector/3706", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-43882 - Linux Kernel Exec Vulnerability: Executer's Privilege Escalation\", \n  \"Content\": \"CVE ID : CVE-2024-43882 \nPublished : Aug. 21, 2024, 1:15 a.m. | 37\u00a0minutes ago \nDescription : In the Linux kernel, the following vulnerability has been resolved:  \n  \nexec: Fix ToCToU between perm check and set-uid/gid usage  \n  \nWhen opening a file for exec via do_filp_open(), permission checking is  \ndone against the file's metadata at that moment, and on success, a file  \npointer is passed back. Much later in the execve() code path, the file  \nmetadata (specifically mode, uid, and gid) is used to determine if/how  \nto set the uid and gid. However, those values may have changed since the  \npermissions check, meaning the execution may gain unintended privileges.  \n  \nFor example, if a file could change permissions from executable and not  \nset-id:  \n  \n---------x 1 root root 16048 Aug  7 13:16 target  \n  \nto set-id and non-executable:  \n  \n---S------ 1 root root 16048 Aug  7 13:16 target  \n  \nit is possible to gain root privileges when execution should have been  \ndisallowed.  \n  \nWhile this race condition is rare in real-world scenarios, it has been  \nobserved (and proven exploitable) when package managers are updating  \nthe setuid bits of installed programs. Such files start with being  \nworld-executable but then are adjusted to be group-exec with a set-uid  \nbit. For example, \"chmod o-x,u+s target\" makes \"target\" executable only  \nby uid \"root\" and gid \"cdrom\", while also becoming setuid-root:  \n  \n-rwxr-xr-x 1 root cdrom 16048 Aug  7 13:16 target  \n  \nbecomes:  \n  \n-rwsr-xr-- 1 root cdrom 16048 Aug  7 13:16 target  \n  \nBut racing the chmod means users without group \"cdrom\" membership can  \nget the permission to execute \"target\" just before the chmod, and when  \nthe chmod finishes, the exec reaches brpm_fill_uid(), and performs the  \nsetuid to root, violating the expressed authorization of \"only cdrom  \ngroup members can setuid to root\".  \n  \nRe-check that we still have execute permissions in case the metadata  \nhas changed. It would be better to keep a copy from the perm-check time,  \nbut until we can do that refactoring, the least-bad option is to do a  \nfull inode_permission() call (under inode lock). It is understood that  \nthis is safe against dead-locks, but hardly optimal. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"21 Aug 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-08-21T04:00:28.000000Z"}, {"uuid": "6821f7ab-a70c-4182-a99d-4d9f29355a73", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-43881", "type": "seen", "source": "https://t.me/cvedetector/3705", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-43881 - \"Qualcomm ath12k WiFi DMA Direction Vulnerability\"\", \n  \"Content\": \"CVE ID : CVE-2024-43881 \nPublished : Aug. 21, 2024, 1:15 a.m. | 37\u00a0minutes ago \nDescription : In the Linux kernel, the following vulnerability has been resolved:  \n  \nwifi: ath12k: change DMA direction while mapping reinjected packets  \n  \nFor fragmented packets, ath12k reassembles each fragment as a normal  \npacket and then reinjects it into HW ring. In this case, the DMA  \ndirection should be DMA_TO_DEVICE, not DMA_FROM_DEVICE. Otherwise,  \nan invalid payload may be reinjected into the HW and  \nsubsequently delivered to the host.  \n  \nGiven that arbitrary memory can be allocated to the skb buffer,  \nknowledge about the data contained in the reinjected buffer is lacking.  \nConsequently, there\u2019s a risk of private information being leaked.  \n  \nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.1.1-00209-QCAHKSWPL_SILICONZ-1 \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"21 Aug 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-08-21T04:00:28.000000Z"}, {"uuid": "e30f9e75-4e90-45e6-962f-3c801cbba64a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-43884", "type": "seen", "source": "https://t.me/cvedetector/4104", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-43884 - Ubuntu Bluetooth NULL Pointer Dereference Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-43884 \nPublished : Aug. 26, 2024, 8:15 a.m. | 36\u00a0minutes ago \nDescription : In the Linux kernel, the following vulnerability has been resolved:  \n  \nBluetooth: MGMT: Add error handling to pair_device()  \n  \nhci_conn_params_add() never checks for a NULL value and could lead to a NULL  \npointer dereference causing a crash.  \n  \nFixed by adding error handling in the function. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"26 Aug 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-08-26T11:12:01.000000Z"}]}