CVE-2024-38385 genirq/irqdesc: Prevent use-after-free in irq_find_at_or_after()
A use-after-free in the Linux kernel's IRQ descriptor handling allows attackers to cause a denial of service or potentially execute code.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-38385?
CVE-2024-38385 is a high-severity use after free vulnerability in Linux kernel, published on 25 Jun 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
genirq/irqdesc: Prevent use-after-free in irq_find_at_or_after()
irq_find_at_or_after() dereferences the interrupt descriptor which is returned by mt_find() while neither holding sparse_irq_lock nor RCU read lock, which means the descriptor can be freed between mt_find() and the dereference:
CPU0 CPU1 desc = mt_find() delayed_free_desc(desc) irq_desc_get_irq(desc)
The use-after-free is reported by KASAN:
Call trace: irq_get_next_irq+0x58/0x84 show_stat+0x638/0x824 seq_read_iter+0x158/0x4ec proc_reg_read_iter+0x94/0x12c vfs_read+0x1e0/0x2c8
Freed by task 4471: slab_free_freelist_hook+0x174/0x1e0 __kmem_cache_free+0xa4/0x1dc kfree+0x64/0x128 irq_kobj_release+0x28/0x3c kobject_put+0xcc/0x1e0 delayed_free_desc+0x14/0x2c rcu_do_batch+0x214/0x720
Guard the access with a RCU read lock section.
Weakness: CWE-416
Which versions are affected by CVE-2024-38385?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-38385?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2024-38385 being exploited?
There is no known exploitation of CVE-2024-38385 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-38385, DEBIAN-CVE-2024-38385, GHSA-6vwm-9rmv-mwwv, UBUNTU-CVE-2024-38385.