[{"vendor":"Siemens","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"*","versionType":"custom","status":"affected"}]}]

{"timestamp":"2025-03-06T16:09:31.243434Z","id":"CVE-2024-50150","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/usb/typec/class.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8a37d87d72f0c69f837229c04d2fcd7117ea57e7","lessThan":"2b0b33e8a58388fa9078f0fbe9af1900e6b08879","versionType":"git","status":"affected"},{"version":"8a37d87d72f0c69f837229c04d2fcd7117ea57e7","lessThan":"2c15c4133d00f5da632fce60ed013fc31aa9aa58","versionType":"git","status":"affected"},{"version":"8a37d87d72f0c69f837229c04d2fcd7117ea57e7","lessThan":"6af43ec3bf40f8b428d9134ffa7a291aecd60da8","versionType":"git","status":"affected"},{"version":"8a37d87d72f0c69f837229c04d2fcd7117ea57e7","lessThan":"87474406056891e4fdea0794e1f632b21b3dfa27","versionType":"git","status":"affected"},{"version":"8a37d87d72f0c69f837229c04d2fcd7117ea57e7","lessThan":"bee1b68cb8bcee4fd3a8bde3a4886e0b1375dc4d","versionType":"git","status":"affected"},{"version":"8a37d87d72f0c69f837229c04d2fcd7117ea57e7","lessThan":"1ded6b12499e6dee9b0e1ceac633be36538f6fc2","versionType":"git","status":"affected"},{"version":"8a37d87d72f0c69f837229c04d2fcd7117ea57e7","lessThan":"68a7c7fe322546be1464174c8d85874b8161deda","versionType":"git","status":"affected"},{"version":"8a37d87d72f0c69f837229c04d2fcd7117ea57e7","lessThan":"befab3a278c59db0cc88c8799638064f6d3fd6f8","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/usb/typec/class.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.19","status":"affected"},{"version":"0","lessThan":"4.19","versionType":"semver","status":"unaffected"},{"version":"4.19.323","lessThanOrEqual":"4.19.*","versionType":"semver","status":"unaffected"},{"version":"5.4.285","lessThanOrEqual":"5.4.*","versionType":"semver","status":"unaffected"},{"version":"5.10.229","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.170","lessThanOrEqual":"5.15.*","versionType"

https://cert-portal.siemens.com/productcert/html/ssa-265688.html

https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html

https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416

NIST AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NIST CWE-416

OR
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.19 up to (excluding) 4.19.323
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.20 up to (excluding) 5.4.285
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 up to (excluding) 5.10.229
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.170
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.115
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.59
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.11.6
     *cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*
     *cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*
     *cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*

https://git.kernel.org/stable/c/1ded6b12499e6dee9b0e1ceac633be36538f6fc2 No Types Assigned

https://git.kernel.org/stable/c/1ded6b12499e6dee9b0e1ceac633be36538f6fc2 Patch

https://git.kernel.org/stable/c/2b0b33e8a58388fa9078f0fbe9af1900e6b08879 No Types Assigned

https://git.kernel.org/stable/c/2b0b33e8a58388fa9078f0fbe9af1900e6b08879 Patch

https://git.kernel.org/stable/c/2c15c4133d00f5da632fce60ed013fc31aa9aa58 No Types Assigned

https://git.kernel.org/stable/c/2c15c4133d00f5da632fce60ed013fc31aa9aa58 Patch

https://git.kernel.org/stable/c/68a7c7fe322546be1464174c8d85874b8161deda No Types Assigned

https://git.kernel.org/stable/c/68a7c7fe322546be1464174c8d85874b8161deda Patch

https://git.kernel.org/stable/c/6af43ec3bf40f8b428d9134ffa7a291aecd60da8 No Types Assigned

https://git.kernel.org/stable/c/6af43ec3bf40f8b428d9134ffa7a291aecd60da8 Patch

https://git.kernel.org/stable/c/87474406056891e4fdea0794e1f632b21b3dfa27 No Types Assigned

https://git.kernel.org/stable/c/87474406056891e4fdea0794e1f632b21b3dfa27 Patch

https://git.kernel.org/stable/c/bee1b68cb8bcee4fd3a8bde3a4886e0b1375dc4d No Types Assigned

https://git.kernel.org/stable/c/bee1b68cb8bcee4fd3a8bde3a4886e0b1375dc4d Patch

https://git.kernel.org/stable/c/befab3a278c59db0cc88c8799638064f6d3fd6f8 No Types Assigned

https://git.kernel.org/stable/c/befab3a278c59db0cc88c8799638064f6d3fd6f8 Patch

kernel.org https://git.kernel.org/stable/c/2b0b33e8a58388fa9078f0fbe9af1900e6b08879 [No types assigned]

kernel.org https://git.kernel.org/stable/c/2c15c4133d00f5da632fce60ed013fc31aa9aa58 [No types assigned]

kernel.org https://git.kernel.org/stable/c/6af43ec3bf40f8b428d9134ffa7a291aecd60da8 [No types assigned]

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: altmode should keep reference to parent

The altmode device release refers to its parent device, but without keeping
a reference to it.

When registering the altmode, get a reference to the parent and put it in
the release function.

Before this fix, when using CONFIG_DEBUG_KOBJECT_RELEASE, we see issues
like this:

[   43.572860] kobject: 'port0.0' (ffff8880057ba008): kobject_release, parent 0000000000000000 (delayed 3000)
[   43.573532] kobject: 'port0.1' (ffff8880057bd008): kobject_release, parent 0000000000000000 (delayed 1000)
[   43.574407] kobject: 'port0' (ffff8880057b9008): kobject_release, parent 0000000000000000 (delayed 3000)
[   43.575059] kobject: 'port1.0' (ffff8880057ca008): kobject_release, parent 0000000000000000 (delayed 4000)
[   43.575908] kobject: 'port1.1' (ffff8880057c9008): kobject_release, parent 0000000000000000 (delayed 4000)
[   43.576908] kobject: 'typec' (ffff8880062dbc00): kobject_release, parent 0000000000000000 (delayed 4000)
[   43.577769] kobject: 'port1' (ffff8880057bf008): kobject_release, parent 0000000000000000 (delayed 3000)
[   46.612867] ==================================================================
[   46.613402] BUG: KASAN: slab-use-after-free in typec_altmode_release+0x38/0x129
[   46.614003] Read of size 8 at addr ffff8880057b9118 by task kworker/2:1/48
[   46.614538]
[   46.614668] CPU: 2 UID: 0 PID: 48 Comm: kworker/2:1 Not tainted 6.12.0-rc1-00138-gedbae730ad31 #535
[   46.615391] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014
[   46.616042] Workqueue: events kobject_delayed_cleanup
[   46.616446] Call Trace:
[   46.616648]  <TASK>
[   46.616820]  dump_stack_lvl+0x5b/0x7c
[   46.617112]  ? typec_altmode_release+0x38/0x129
[   46.617470]  print_report+0x14c/0x49e
[   46.617769]  ? rcu_read_unlock_sched+0x56/0x69
[   46.618117]  ? __virt_addr_valid+0x19a/0x1ab
[   46.618456]  ? kmem_cache_debug_flags+0xc/0x1d
[   46.618807]  ? typec_altmode_release+0x38

kernel.org https://git.kernel.org/stable/c/1ded6b12499e6dee9b0e1ceac633be36538f6fc2 [No types assigned]

kernel.org https://git.kernel.org/stable/c/68a7c7fe322546be1464174c8d85874b8161deda [No types assigned]

kernel.org https://git.kernel.org/stable/c/87474406056891e4fdea0794e1f632b21b3dfa27 [No types assigned]

kernel.org https://git.kernel.org/stable/c/bee1b68cb8bcee4fd3a8bde3a4886e0b1375dc4d [No types assigned]

kernel.org https://git.kernel.org/stable/c/befab3a278c59db0cc88c8799638064f6d3fd6f8 [No types assigned]