CVE-2024-43830 leds: trigger: Unregister sysfs attributes before calling deactivate()
A race condition in the Linux kernel LED trigger subsystem allows use-after-free, potentially leading to code execution or system crash.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-43830?
CVE-2024-43830 is a high-severity use after free vulnerability in Linux kernel, published on 17 Aug 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
leds: trigger: Unregister sysfs attributes before calling deactivate()
Triggers which have trigger specific sysfs attributes typically store related data in trigger-data allocated by the activate() callback and freed by the deactivate() callback.
Calling device_remove_groups() after calling deactivate() leaves a window where the sysfs attributes show/store functions could be called after deactivation and then operate on the just freed trigger-data.
Move the device_remove_groups() call to before deactivate() to close this race window.
This also makes the deactivation path properly do things in reverse order of the activation path which calls the activate() callback before calling device_add_groups().
Weakness: CWE-416
Which versions are affected by CVE-2024-43830?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-43830?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2024-43830 being exploited?
There is no known exploitation of CVE-2024-43830 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-43830, DEBIAN-CVE-2024-43830, GHSA-h5x3-2xcq-h4j8, UBUNTU-CVE-2024-43830.