CVE-2024-49874 i3c: master: svc: Fix use after free vulnerability in svc_i3c_master Driver Due to Race Condition
A race condition in the Linux kernel's svc_i3c_master driver allows a use-after-free, potentially enabling local attackers to execute code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-49874?
CVE-2024-49874 is a high-severity use after free vulnerability in Linux kernel, published on 21 Oct 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
i3c: master: svc: Fix use after free vulnerability in svc_i3c_master Driver Due to Race Condition
In the svc_i3c_master_probe function, &master->hj_work is bound with svc_i3c_master_hj_work, &master->ibi_work is bound with svc_i3c_master_ibi_work. And svc_i3c_master_ibi_work can start the hj_work, svc_i3c_master_irq_handler can start the ibi_work.
If we remove the module which will call svc_i3c_master_remove to make cleanup, it will free master->base through i3c_master_unregister while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows:
CPU0 CPU1
| svc_i3c_master_hj_work svc_i3c_master_remove | i3c_master_unregister(&master->base)| device_unregister(&master->dev) | device_release | //free master->base | | i3c_master_do_daa(&master->base) | //use master->base
Fix it by ensuring that the work is canceled before proceeding with the cleanup in svc_i3c_master_remove.
Weakness: CWE-416
Which versions are affected by CVE-2024-49874?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-49874?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2024-49874 being exploited?
There is no known exploitation of CVE-2024-49874 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-51237, BELL-CVE-2024-49874, DEBIAN-CVE-2024-49874, GHSA-wg4j-4q4f-6cfc, UBUNTU-CVE-2024-49874.