CVE-2024-39495

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-39495
In the Linux kernel, the following vulnerability has been resolved: greybus: Fix use-after-free bug in gb_interface_release due to race condition. In gb_interface_create, &intf->mode_switch_completion is bound with gb_interface_mode_switch_work. Then it will be started by gb_interface_request_mode_switch. Here is the relevant code. if (!queue_work(system_long_wq, &intf->mode_switch_work)) { ... } If we call gb_interface_release to make cleanup, there may be an unfinished work. This function will call kfree to free the object "intf". However, if gb_interface_mode_switch_work is scheduled to run after kfree, it may cause use-after-free error as gb_interface_mode_switch_work will use the object "intf". The possible execution flow that may lead to the issue is as follows: CPU0 CPU1 | gb_interface_create | gb_interface_request_mode_switch gb_interface_release | kfree(intf) (free) | | gb_interface_mode_switch_work | mutex_lock(&intf->mutex) (use) Fix it by canceling the work before kfree.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/03ea2b129344152157418929f06726989efc0445 Patch
https://git.kernel.org/stable/c/0b8fba38bdfb848fac52e71270b2aa3538c996ea Patch
https://git.kernel.org/stable/c/2b6bb0b4abfd79b8698ee161bb73c0936a2aaf83 Patch
https://git.kernel.org/stable/c/5c9c5d7f26acc2c669c1dcf57d1bb43ee99220ce Patch
https://git.kernel.org/stable/c/74cd0a421896b2e07eafe7da4275302bfecef201 Patch
https://git.kernel.org/stable/c/9a733d69a4a59c2d08620e6589d823c24be773dc Patch
https://git.kernel.org/stable/c/fb071f5c75d4b1c177824de74ee75f9dd34123b9 Patch
https://git.kernel.org/stable/c/03ea2b129344152157418929f06726989efc0445 Patch
https://git.kernel.org/stable/c/0b8fba38bdfb848fac52e71270b2aa3538c996ea Patch
https://git.kernel.org/stable/c/2b6bb0b4abfd79b8698ee161bb73c0936a2aaf83 Patch
https://git.kernel.org/stable/c/5c9c5d7f26acc2c669c1dcf57d1bb43ee99220ce Patch
https://git.kernel.org/stable/c/74cd0a421896b2e07eafe7da4275302bfecef201 Patch
https://git.kernel.org/stable/c/9a733d69a4a59c2d08620e6589d823c24be773dc Patch
https://git.kernel.org/stable/c/fb071f5c75d4b1c177824de74ee75f9dd34123b9 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

21 Nov 2024, 09:27

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/03ea2b129344152157418929f06726989efc0445 - Patch () https://git.kernel.org/stable/c/03ea2b129344152157418929f06726989efc0445 - Patch
References () https://git.kernel.org/stable/c/0b8fba38bdfb848fac52e71270b2aa3538c996ea - Patch () https://git.kernel.org/stable/c/0b8fba38bdfb848fac52e71270b2aa3538c996ea - Patch
References () https://git.kernel.org/stable/c/2b6bb0b4abfd79b8698ee161bb73c0936a2aaf83 - Patch () https://git.kernel.org/stable/c/2b6bb0b4abfd79b8698ee161bb73c0936a2aaf83 - Patch
References () https://git.kernel.org/stable/c/5c9c5d7f26acc2c669c1dcf57d1bb43ee99220ce - Patch () https://git.kernel.org/stable/c/5c9c5d7f26acc2c669c1dcf57d1bb43ee99220ce - Patch
References () https://git.kernel.org/stable/c/74cd0a421896b2e07eafe7da4275302bfecef201 - Patch () https://git.kernel.org/stable/c/74cd0a421896b2e07eafe7da4275302bfecef201 - Patch
References () https://git.kernel.org/stable/c/9a733d69a4a59c2d08620e6589d823c24be773dc - Patch () https://git.kernel.org/stable/c/9a733d69a4a59c2d08620e6589d823c24be773dc - Patch
References () https://git.kernel.org/stable/c/fb071f5c75d4b1c177824de74ee75f9dd34123b9 - Patch () https://git.kernel.org/stable/c/fb071f5c75d4b1c177824de74ee75f9dd34123b9 - Patch

24 Jul 2024, 19:04

Type Values Removed Values Added
CWE CWE-416
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: greybus: corrigió el error de use-after-free en gb_interface_release debido a la condición de ejecución. En gb_interface_create, &intf->mode_switch_completion está vinculado con gb_interface_mode_switch_work. Luego lo iniciará gb_interface_request_mode_switch. Aquí está el código relevante. if (!queue_work(system_long_wq, &intf->mode_switch_work)) { ... } Si llamamos a gb_interface_release para realizar la limpieza, es posible que haya un trabajo sin terminar. Esta función llamará a kfree para liberar el objeto "intf". Sin embargo, si gb_interface_mode_switch_work está programado para ejecutarse después de kfree, puede causar un error de use-after-free ya que gb_interface_mode_switch_work usará el objeto "intf". El posible flujo de ejecución que puede provocar el problema es el siguiente: CPU0 CPU1 | gb_interface_create | gb_interface_request_mode_switch gb_interface_release | kfree(intf) (gratis) | | gb_interface_mode_switch_work | mutex_lock(&intf->mutex) (uso) Solucionarlo cancelando el trabajo antes de kfree.
References () https://git.kernel.org/stable/c/03ea2b129344152157418929f06726989efc0445 - () https://git.kernel.org/stable/c/03ea2b129344152157418929f06726989efc0445 - Patch
References () https://git.kernel.org/stable/c/0b8fba38bdfb848fac52e71270b2aa3538c996ea - () https://git.kernel.org/stable/c/0b8fba38bdfb848fac52e71270b2aa3538c996ea - Patch
References () https://git.kernel.org/stable/c/2b6bb0b4abfd79b8698ee161bb73c0936a2aaf83 - () https://git.kernel.org/stable/c/2b6bb0b4abfd79b8698ee161bb73c0936a2aaf83 - Patch
References () https://git.kernel.org/stable/c/5c9c5d7f26acc2c669c1dcf57d1bb43ee99220ce - () https://git.kernel.org/stable/c/5c9c5d7f26acc2c669c1dcf57d1bb43ee99220ce - Patch
References () https://git.kernel.org/stable/c/74cd0a421896b2e07eafe7da4275302bfecef201 - () https://git.kernel.org/stable/c/74cd0a421896b2e07eafe7da4275302bfecef201 - Patch
References () https://git.kernel.org/stable/c/9a733d69a4a59c2d08620e6589d823c24be773dc - () https://git.kernel.org/stable/c/9a733d69a4a59c2d08620e6589d823c24be773dc - Patch
References () https://git.kernel.org/stable/c/fb071f5c75d4b1c177824de74ee75f9dd34123b9 - () https://git.kernel.org/stable/c/fb071f5c75d4b1c177824de74ee75f9dd34123b9 - Patch
First Time Linux
Linux linux Kernel
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8

12 Jul 2024, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-12 13:15

Updated : 2024-11-21 09:27

NVD link : CVE-2024-39495

Mitre link : CVE-2024-39495

CVE.ORG link : CVE-2024-39495

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free