{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2024-35858",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2024-35858"
  ],
  "published": "2024-05-17T14:47:56Z",
  "summary": "net: bcmasp: fix memory leak when bringing down interface",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bcmasp: fix memory leak when bringing down interface\n\nWhen bringing down the TX rings we flush the rings but forget to\nreclaimed the flushed packets. This leads to a memory leak since we\ndo not free the dma mapped buffers. This also leads to tx control\nblock corruption when bringing down the interface for power\nmanagement.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.6.20-1+rpt1",
        "1:6.6.28-1+rpt1"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.6.20+rpt-rpi-2712",
            "binary_version": "1:6.6.20-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.20+rpt-rpi-v8",
            "binary_version": "1:6.6.20-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.28+rpt-rpi-2712",
            "binary_version": "1:6.6.28-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.28+rpt-rpi-v8",
            "binary_version": "1:6.6.28-1+rpt1"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.6.20-1+rpt1": {
            "linux_commit": "6f16847710cc0502450788b9f12f0a14d3429668",
            "upstream_version": "6.6.20",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.6.30"
          },
          "1:6.6.28-1+rpt1": {
            "linux_commit": "0c341f47adc3578cd5f817aa20ee2b7f9ae6b23e",
            "upstream_version": "6.6.28",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.6.30"
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35858"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/09040baf8779ad880e0e0d0ea10e57aa929ef3ab"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/2389ad1990163d29cba5480d693b4c2e31cc545c"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/9f898fc2c31fbf0ac5ecd289f528a716464cb005"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T11:52:36Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.8,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - The vulnerable code is the `bcmasp_netif_deinit()` teardown path of a platform Ethernet driver, reached only via `ndo_stop` (`ip link set down`) or a local PM suspend/resume cycle. No received packet or remote protocol interaction can drive interface teardown, so this requires local system access.\nAC:L - The triggering party controls both halves \u2014 flooding fragmented TX traffic guarantees in-flight descriptors at teardown, and the tiny `DESC_RING_COUNT` ring wraps into the stale `tx_cbs` region within milliseconds of resuming, so the premature `dev_consume_skb_any()` and subsequent double free are deterministic and repeatable. No unpredictable memory layout or victim state is required.\nPR:L - On the BRCMSTB set-top/embedded systems this driver targets, the suspend-to-WoL standby cycle that produces the `tx_cbs` corruption is an automatic system event, not an attacker privilege; an unprivileged local process only needs to be generating fragmented TX traffic when it occurs. Choosing the higher-severity option between low privilege and root, since the corruption path does not itself depend on CAP_NET_ADMIN.\nUI:N - Idle/autosleep standby entry and admin-scripted interface cycling (NetworkManager, DHCP renewal, WoL standby) occur with no victim action. The leak accrues on every interface-down with no interaction at all.\nS:U - The leaked memory, freed skbs, and corrupted slab freelist all live within the kernel's own security authority. There is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The stale `last` flag frees an skb (releasing its fragment page references) while later descriptors for that same skb are still pending in the hardware ring and still DMA-mapped, so reallocated pages holding other processes' data can be DMA'd out onto the wire. The resulting `skbuff_head_cache` double free additionally yields overlapping allocations usable as a kernel read primitive.\nI:H - Freeing the same skb twice corrupts the SLUB freelist, allowing two live objects to alias the same memory \u2014 the standard route to a controlled kernel write and control-flow hijack. Skipped `dma_unmap_single()` also leaves the device with live mappings into memory that has been returned to the allocator.\nA:H - The double free trips SLUB's detection (BUG/panic) or silently corrupts the allocator into a later oops. Independently, the unreclaimed skbs and DMA mappings leak on every interface-down, exhausting memory and SWIOTLB/IOVA space over repeated up/down or standby cycles."
    }
  }
}