In the Linux kernel, the following vulnerability has been resolved: crypto: rk3288 - Fix use after free in unprepare The unprepare call must be… (CVE-2024-35792)
A use-after-free vulnerability in the Linux kernel's crypto subsystem for rk3288 has been resolved. The issue arises because the unprepare call was not performed before the finalize call, which can free the request prematurely. This flaw could lead to high impact on confidentiality, integrity, and availability. The vulnerability is tracked as CVE-2024-35792 and has a CVSS 3.1 score of 7.8 (high severity).
AI Analysis
Technical Summary
CVE-2024-35792 is a use-after-free vulnerability in the Linux kernel's crypto driver for rk3288. The root cause is that the unprepare call must be executed before the finalize call, as the finalize call can free the request object. Failure to do so results in a use-after-free condition, which can lead to memory corruption and potentially compromise system security. This vulnerability has been resolved in the Linux kernel.
Potential Impact
Exploitation of this vulnerability can result in high impact on confidentiality, integrity, and availability of the affected system due to use-after-free memory corruption. This could allow an attacker with local privileges to execute arbitrary code or cause a denial of service.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel. Users should update to the latest kernel version that includes this patch. Since this is not a cloud service, remediation depends on applying the official kernel update. Patch status is not explicitly confirmed in the provided data; check the Linux kernel vendor advisory for the exact fixed versions and update accordingly.
In the Linux kernel, the following vulnerability has been resolved: crypto: rk3288 - Fix use after free in unprepare The unprepare call must be… (CVE-2024-35792)
Description
A use-after-free vulnerability in the Linux kernel's crypto subsystem for rk3288 has been resolved. The issue arises because the unprepare call was not performed before the finalize call, which can free the request prematurely. This flaw could lead to high impact on confidentiality, integrity, and availability. The vulnerability is tracked as CVE-2024-35792 and has a CVSS 3.1 score of 7.8 (high severity).
CVSS v3.1
Score 7.8high
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-35792 is a use-after-free vulnerability in the Linux kernel's crypto driver for rk3288. The root cause is that the unprepare call must be executed before the finalize call, as the finalize call can free the request object. Failure to do so results in a use-after-free condition, which can lead to memory corruption and potentially compromise system security. This vulnerability has been resolved in the Linux kernel.
Potential Impact
Exploitation of this vulnerability can result in high impact on confidentiality, integrity, and availability of the affected system due to use-after-free memory corruption. This could allow an attacker with local privileges to execute arbitrary code or cause a denial of service.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel. Users should update to the latest kernel version that includes this patch. Since this is not a cloud service, remediation depends on applying the official kernel update. Patch status is not explicitly confirmed in the provided data; check the Linux kernel vendor advisory for the exact fixed versions and update accordingly.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-gf77-wgv9-4v74
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2024-35792"]
- Ecosystems
- []
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a71feebbf8831d539ff12d7
Added to database: 08/04/2026, 15:02:03 UTC
Last enriched: 08/04/2026, 15:18:24 UTC
Last updated: 08/04/2026, 16:00:55 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.