CVE-2024-39495 greybus: Fix use-after-free bug in gb_interface_release due to race condition.
A race condition in the Linux kernel's greybus driver allows a use-after-free, potentially enabling local attackers to execute code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-39495?
CVE-2024-39495 is a high-severity use after free vulnerability in Linux kernel, published on 12 Jul 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
greybus: Fix use-after-free bug in gb_interface_release due to race condition.
In gb_interface_create, &intf->mode_switch_completion is bound with gb_interface_mode_switch_work. Then it will be started by gb_interface_request_mode_switch. Here is the relevant code. if (!queue_work(system_long_wq, &intf->mode_switch_work)) { ... }
If we call gb_interface_release to make cleanup, there may be an unfinished work. This function will call kfree to free the object "intf". However, if gb_interface_mode_switch_work is scheduled to run after kfree, it may cause use-after-free error as gb_interface_mode_switch_work will use the object "intf". The possible execution flow that may lead to the issue is as follows:
CPU0 CPU1
| gb_interface_create | gb_interface_request_mode_switch gb_interface_release | kfree(intf) (free) | | gb_interface_mode_switch_work | mutex_lock(&intf->mutex) (use)
Fix it by canceling the work before kfree.
Weakness: CWE-416
Which versions are affected by CVE-2024-39495?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-39495?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2024-39495 being exploited?
There is no known exploitation of CVE-2024-39495 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-46990, BELL-CVE-2024-39495, DEBIAN-CVE-2024-39495, GHSA-cx8j-9h8g-m439, UBUNTU-CVE-2024-39495.