CVE-2024-49924 Information

Description

In the Linux kernel the following vulnerability has been resolved:

fbdev: pxafb: Fix possible use after free in pxafb_task()

In the pxafb_probe function it calls the pxafb_init_fbinfo function after which &fbi->task is associated with pxafb_task. Moreover within this pxafb_init_fbinfo function the pxafb_blank function within the &pxafb_ops struct is capable of scheduling work.

If we remove the module which will call pxafb_remove to make cleanup it will call unregister_framebuffer function which can call do_unregister_framebuffer to free fbi->fb through put_fb_info(fb_info) while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows:

CPU0 CPU1

                               | pxafb_task

pxafb_remove | unregister_framebuffer(info) | do_unregister_framebuffer(fb_info) | put_fb_info(fb_info) | // free fbi->fb | set_ctrlr_state(fbi state) | __pxafb_lcd_power(fbi 0) | fbi->lcd_power(on &fbi->fb.var) | //use fbi->fb

Fix it by ensuring that the work is canceled before proceeding with the cleanup in pxafb_remove.

Note that only root user can remove the driver at runtime.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Reference

https://git.kernel.org/stable/c/e6897e299f57b103e999e62010b88e363b3eebae https://git.kernel.org/stable/c/4cda484e584be34d55ee17436ebf7ad11922b97a https://git.kernel.org/stable/c/3c0d416eb4bef705f699213cee94bf54b6acdacd https://git.kernel.org/stable/c/fdda354f60a576d52dcf90351254714681df4370 https://git.kernel.org/stable/c/aaadc0cb05c999ccd8898a03298b7e5c31509b08 https://git.kernel.org/stable/c/a3a855764dbacbdb1cc51e15dc588f2d21c93e0e https://git.kernel.org/stable/c/4a6921095eb04a900e0000da83d9475eb958e61e

Attack Complexity

LOW

Privileges Required

LOW

User Interaction Required

LOW

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

7.8