Linux: Use After Free
CVE-2024-53194 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 50473dd3b2a08601a078f852ea05572de9b1f86c, d0ddd2c92b75a19a37c887154223372b600fed37, da6e6ff1f6c57f16e07af955e0e997fc90dd1e75 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.24% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 50473dd3b2a08601a078f852ea05572de9b1f86c or d0ddd2c92b75a19a37c887154223372b600fed37 or da6e6ff1f6c57f16e07af955e0e997fc90dd1e75 or 41bbb1eb996be1435815aa1fbcc9ffc45b84cc12, whichever matches your release line, or a later version.
- Update Linux Kernel to 4.19.325 or 5.4.287 or 5.10.231 or 5.15.174, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | f46753c5e354b857b20ab8e0fe7b2579831dc369 up to, but not including, 50473dd3b2a08601a078f852ea05572de9b1f86c; f46753c5e354b857b20ab8e0fe7b2579831dc369 up to, but not including, d0ddd2c92b75a19a37c887154223372b600fed37; f46753c5e354b857b20ab8e0fe7b2579831dc369 up to, but not including, da6e6ff1f6c57f16e07af955e0e997fc90dd1e75; f46753c5e354b857b20ab8e0fe7b2579831dc369 up to, but not including, 41bbb1eb996be1435815aa1fbcc9ffc45b84cc12; f46753c5e354b857b20ab8e0fe7b2579831dc369 up to, but not including, 20502f0b3f3acd6bee300257556c27a867f80c8b; f46753c5e354b857b20ab8e0fe7b2579831dc369 up to, but not including, e5d5c04aac71bf1476dc44b56f2206a4c2facca8; f46753c5e354b857b20ab8e0fe7b2579831dc369 up to, but not including, c8266ab8e7ccd1d1f5a9c8b29eb2020175048134; f46753c5e354b857b20ab8e0fe7b2579831dc369 up to, but not including, 69d2ceac11acf8579d58d55c9c5b65fb658f916e; and 2 more ranges | 50473dd3b2a08601a078f852ea05572de9b1f86c, d0ddd2c92b75a19a37c887154223372b600fed37, da6e6ff1f6c57f16e07af955e0e997fc90dd1e75, 41bbb1eb996be1435815aa1fbcc9ffc45b84cc12, 20502f0b3f3acd6bee300257556c27a867f80c8b, e5d5c04aac71bf1476dc44b56f2206a4c2facca8 |
| Linux | Linux Kernel | before 4.19.325; 4.20 up to, but not including, 5.4.287; 5.5 up to, but not including, 5.10.231; 5.11 up to, but not including, 5.15.174; 5.16 up to, but not including, 6.1.120; 6.2 up to, but not including, 6.6.64; 6.7 up to, but not including, 6.11.11; 6.12 up to, but not including, 6.12.2 | 4.19.325, 5.4.287, 5.10.231, 5.15.174, 6.1.120, 6.6.64 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CISA (ADP).
Official description
In the Linux kernel, the following vulnerability has been resolved: PCI: Fix use-after-free of slot->bus on hot remove Dennis reports a boot crash on recent Lenovo laptops with a USB4 dock. Since commit 0fc70886569c ("thunderbolt: Reset USB4 v2 host router") and commit 59a54c5f3dbd ("thunderbolt: Reset topology created by the boot firmware"), USB4 v2 and v1 Host Routers are reset on probe of the thunderbolt driver. The reset clears the Presence Detect State and Data Link Layer Link Active bits at the USB4 Host Router's Root Port and thus causes hot removal of the dock. The crash occurs when pciehp is unbound from one of the dock's Downstream Ports: pciehp creates a pci_slot on bind and destroys it on unbind. The pci_slot contains a pointer to the pci_bus below the Downstream Port, but a reference on that pci_bus is never acquired. The pci_bus is destroyed before the pci_slot, so a use-after-free ensues when pci_slot_release() accesses slot->bus. In principle this should not happen because pci_stop_bus_device() unbinds pciehp (and therefore destroys the pci_slot) before the pci_bus is destroyed by pci_remove_bus_device(). However the stacktrace provided by Dennis shows that pciehp is unbound from pci_remove_bus_device() instead of pci_stop_bus_device(). To understand the significance of this, one needs to know that the PCI core uses a two step process to remove a portion of the hierarchy: It first unbinds all drivers in the sub-hierarchy in pci_stop_bus_device() and then actually removes the devices in pci_remove_bus_device(). There is no precaution to prevent driver binding in-between pci_stop_bus_device() and pci_remove_bus_device(). In Dennis' case, it seems removal of the hierarchy by pciehp races with driver binding by pci_bus_add_devices(). pciehp is bound to the Downstream Port after pci_stop_bus_device() has run, so it is unbound by pci_remove_bus_device() instead of pci_stop_bus_device(). Because the pci_bus has already been destroyed at that point, accesses to it result in a use-after-free. One might conclude that driver binding needs to be prevented after pci_stop_bus_device() has run. However it seems risky that pci_slot points to pci_bus without holding a reference. Solely relying on correct ordering of driver unbind versus pci_bus destruction is certainly not defensive programming. If pci_slot has a need to access data in pci_bus, it ought to acquire a reference. Amend pci_create_slot() accordingly. Dennis reports that the crash is not reproducible with this change. Abridged stacktrace: pcieport 0000:00:07.0: PME: Signaling with IRQ 156 pcieport 0000:00:07.0: pciehp: Slot #12 AttnBtn- PwrCtrl- MRL- AttnInd- PwrInd- HotPlug+ Surprise+ Interlock- NoCompl+ IbPresDis- LLActRep+ pci_bus 0000:20: dev 00, created physical slot 12 pcieport 0000:00:07.0: pciehp: Slot(12): Card not present ... pcieport 0000:21:02.0: pciehp: pcie_disable_notification: SLOTCTRL d8 write cmd 0 Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP NOPTI CPU: 13 UID: 0 PID: 134 Comm: irq/156-pciehp Not tainted 6.11.0-devel+ #1 RIP: 0010:dev_driver_string+0x12/0x40 pci_destroy_slot pciehp_remove pcie_port_remove_service device_release_driver_internal bus_remove_device device_del device_unregister remove_iter device_for_each_child pcie_portdrv_remove pci_device_remove device_release_driver_internal bus_remove_device device_del pci_remove_bus_device (recursive invocation) pci_remove_bus_device pciehp_unconfigure_device pciehp_disable_slot pciehp_handle_presence_or_link_change pciehp_ist
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/20502f0b3f3acd6bee300257556c27a867f80c8b
- git.kernel.org/stable/c/41bbb1eb996be1435815aa1fbcc9ffc45b84cc12
- git.kernel.org/stable/c/50473dd3b2a08601a078f852ea05572de9b1f86c
- git.kernel.org/stable/c/69d2ceac11acf8579d58d55c9c5b65fb658f916e
- git.kernel.org/stable/c/c7acef99642b763ba585f4a43af999fcdbcc3dc4
- git.kernel.org/stable/c/c8266ab8e7ccd1d1f5a9c8b29eb2020175048134
- git.kernel.org/stable/c/d0ddd2c92b75a19a37c887154223372b600fed37
- git.kernel.org/stable/c/da6e6ff1f6c57f16e07af955e0e997fc90dd1e75
- git.kernel.org/stable/c/e5d5c04aac71bf1476dc44b56f2206a4c2facca8
Other references
Recent Use After Free vulnerabilities
- 7.8 High severity
- 7.0 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
Spotted an error? Tell us.