CVE-2024-50269 usb: musb: sunxi: Fix accessing an released usb phy
A use-after-free vulnerability in the Linux kernel's sunxi MUSB USB driver allows attackers to cause a denial of service or potentially execute code.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-50269?
CVE-2024-50269 is a high-severity use after free vulnerability in Linux kernel, published on 19 Nov 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
usb: musb: sunxi: Fix accessing an released usb phy
Commit 6ed05c68cbca ("usb: musb: sunxi: Explicitly release USB PHY on exit") will cause that usb phy @glue->xceiv is accessed after released.
1) register platform driver @sunxi_musb_driver // get the usb phy @glue->xceiv sunxi_musb_probe() -> devm_usb_get_phy().
2) register and unregister platform driver @musb_driver musb_probe() -> sunxi_musb_init() use the phy here //the phy is released here musb_remove() -> sunxi_musb_exit() -> devm_usb_put_phy()
3) register @musb_driver again musb_probe() -> sunxi_musb_init() use the phy here but the phy has been released at 2). ...
Fixed by reverting the commit, namely, removing devm_usb_put_phy() from sunxi_musb_exit().
Weakness: CWE-416
Which versions are affected by CVE-2024-50269?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-50269?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2024-50269 being exploited?
There is no known exploitation of CVE-2024-50269 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-53727, BELL-CVE-2024-50269, DEBIAN-CVE-2024-50269, GHSA-xrw7-56rh-2jrq, UBUNTU-CVE-2024-50269.