CVE-2024-53213

What it actually does

Double free of the interrupt buffer allocated for usb_fill_int_urb in lan78xx_probe() caused by calling kfree after usb_free_urb with URB_FREE_BUFFER flag.

Why it matters to the business

Local memory corruption on Linux systems using lan78xx USB Ethernet adapters can produce kernel crashes, denial of service, or local privilege escalation; the issue affects many distributions and embedded devices though exploitability remains low.

How an attack unfolds

An attacker with local access attaches a lan78xx-based USB device that triggers the probe path; the double-free corrupts kernel heap metadata which is then leveraged for arbitrary read/write or control-flow hijacking.

How to fix it

Upgrade the Linux kernel to a version containing commit 977128343fc2a30737399b58df8ea77e94f164bd or later; rebuild and reboot all affected systems; remove or disable lan78xx modules only if hardware is not required.

How to confirm the fix worked

Verify the running kernel contains the fix commit or is newer than the vulnerable versions; inspect lan78xx.c to confirm kmalloc occurs after usb_alloc_urb and no explicit kfree of the interrupt buffer remains.

Typical attack path

1. Obtain local shell or physical access
2. Insert or enumerate lan78xx USB device
3. Trigger lan78xx_probe via usb core
4. Exploit resulting double-free heap corruption
5. Escalate privileges or crash the kernel

How to detect it

Search kernel logs and crash dumps for slab double-free warnings, use-after-free traces, or panics referencing lan78xx_probe or usb_free_urb; correlate with recent USB device insertion events.

What your security team should do

• Prioritize kernel updates on all systems exposing lan78xx hardware
• Scan package managers for backported fixes in distribution kernels
• Restrict untrusted local users and USB device attachment until patched
• Monitor kernel logs for URB or slab corruption messages during USB enumeration