cbcvebase.
CVE-2024-49924
published 2024-10-21

CVE-2024-49924: In the Linux kernel, the following vulnerability has been resolved: fbdev: pxafb: Fix possible use after free in pxafb_task() In the pxafb_probe function, it…

PriorityP339high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.25%
16.4th percentile
In the Linux kernel, the following vulnerability has been resolved: fbdev: pxafb: Fix possible use after free in pxafb_task() In the pxafb_probe function, it calls the pxafb_init_fbinfo function, after which &fbi->task is associated with pxafb_task. Moreover, within this pxafb_init_fbinfo function, the pxafb_blank function within the &pxafb_ops struct is capable of scheduling work. If we remove the module which will call pxafb_remove to make cleanup, it will call unregister_framebuffer function which can call do_unregister_framebuffer to free fbi->fb through put_fb_info(fb_info), while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows: CPU0 CPU1 | pxafb_task pxafb_remove | unregister_framebuffer(info) | do_unregister_framebuffer(fb_info) | put_fb_info(fb_info) | // free fbi->fb | set_ctrlr_state(fbi, state) | __pxafb_lcd_power(fbi, 0) | fbi->lcd_power(on, &fbi->fb.var) | //use fbi->fb Fix it by ensuring that the work is canceled before proceeding with the cleanup in pxafb_remove. Note that only root user can remove the driver at runtime.

Affected

38 ranges· showing 25
VendorProductVersion rangeFixed in
debiandebian_linux
debianlinux< linux 6.1.115-1 (bookworm)linux 6.1.115-1 (bookworm)
debianlinux-6.1< linux 6.1.115-1 (bookworm)linux 6.1.115-1 (bookworm)
linuxlinux
linuxlinux>= 9f17f2874834f4cdbe48cc05676d8f7558793204 < e657fa2df4429f3805a9b3e47fb1a4a1b02a72bde657fa2df4429f3805a9b3e47fb1a4a1b02a72bd
linuxlinux>= 9f17f2874834f4cdbe48cc05676d8f7558793204 < 6d0a07f68b66269e167def6c0b90a219cd3e74736d0a07f68b66269e167def6c0b90a219cd3e7473
linuxlinux>= 9f17f2874834f4cdbe48cc05676d8f7558793204 < e6897e299f57b103e999e62010b88e363b3eebaee6897e299f57b103e999e62010b88e363b3eebae
linuxlinux>= 9f17f2874834f4cdbe48cc05676d8f7558793204 < 4cda484e584be34d55ee17436ebf7ad11922b97a4cda484e584be34d55ee17436ebf7ad11922b97a
linuxlinux>= 9f17f2874834f4cdbe48cc05676d8f7558793204 < 3c0d416eb4bef705f699213cee94bf54b6acdacd3c0d416eb4bef705f699213cee94bf54b6acdacd
linuxlinux>= 9f17f2874834f4cdbe48cc05676d8f7558793204 < fdda354f60a576d52dcf90351254714681df4370fdda354f60a576d52dcf90351254714681df4370
linuxlinux>= 9f17f2874834f4cdbe48cc05676d8f7558793204 < aaadc0cb05c999ccd8898a03298b7e5c31509b08aaadc0cb05c999ccd8898a03298b7e5c31509b08
linuxlinux>= 9f17f2874834f4cdbe48cc05676d8f7558793204 < a3a855764dbacbdb1cc51e15dc588f2d21c93e0ea3a855764dbacbdb1cc51e15dc588f2d21c93e0e
linuxlinux>= 9f17f2874834f4cdbe48cc05676d8f7558793204 < 4a6921095eb04a900e0000da83d9475eb958e61e4a6921095eb04a900e0000da83d9475eb958e61e
linuxlinux_kernel>= 0 < 6.1.115-16.1.115-1
linuxlinux_kernel>= 0 < 6.11.4-16.11.4-1
linuxlinux_kernel>= 0 < 6.11.4-16.11.4-1
linuxlinux_kernel>= 0 < 5.4.0-208.2285.4.0-208.228
linuxlinux_kernel>= 0 < 5.15.0-127.1375.15.0-127.137
linuxlinux_kernel>= 0 < 6.8.0-54.566.8.0-54.56
linuxlinux_kernel>= 0 < 6.11.0-18.186.11.0-18.18
linuxlinux_kernel>= 0 < 4.4.0-273.3074.4.0-273.307
linuxlinux_kernel>= 0 < 4.15.0-242.2544.15.0-242.254
linuxlinux_kernel>= 2.6.27 < 4.19.3234.19.323
linuxlinux_kernel>= 4.20 < 5.4.2855.4.285
linuxlinux_kernel>= 5.11 < 5.15.1685.15.168

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv8.8HIGH
vendor_ubuntu8.8HIGH
vendor_debian7.8HIGH
vendor_msrc7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.