CVE-2024-26875: media: pvrusb2: fix uaf in pvr2_context_set_notify
In the Linux kernel, the following vulnerability has been resolved:
media: pvrusb2: fix uaf in pvr2contextsetnotify
[Syzbot reported] BUG: KASAN: slab-use-after-free in pvr2contextsetnotify+0x2c4/0x310 drivers/media/usb/pvrusb2/pvrusb2-context.c:35 Read of size 4 at addr ffff888113aeb0d8 by task kworker/1:1/26
CPU: 1 PID: 26 Comm: kworker/1:1 Not tainted 6.8.0-rc1-syzkaller-00046-gf1a27f081c1f #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 Workqueue: usbhubwq hubevent Call Trace: <TASK> dumpstack lib/dumpstack.c:88 [inline] dumpstacklvl+0xd9/0x1b0 lib/dumpstack.c:106 printaddressdescription mm/kasan/report.c:377 [inline] printreport+0xc4/0x620 mm/kasan/report.c:488 kasanreport+0xda/0x110 mm/kasan/report.c:601 pvr2contextsetnotify+0x2c4/0x310 drivers/media/usb/pvrusb2/pvrusb2-context.c:35 pvr2contextnotify drivers/media/usb/pvrusb2/pvrusb2-context.c:95 [inline] pvr2contextdisconnect+0x94/0xb0 drivers/media/usb/pvrusb2/pvrusb2-context.c:272
Freed by task 906: kasansavestack+0x33/0x50 mm/kasan/common.c:47 kasansavetrack+0x14/0x30 mm/kasan/common.c:68 kasansavefreeinfo+0x3f/0x60 mm/kasan/generic.c:640 poisonslabobject mm/kasan/common.c:241 [inline] kasanslabfree+0x106/0x1b0 mm/kasan/common.c:257 kasanslabfree include/linux/kasan.h:184 [inline] slabfreehook mm/slub.c:2121 [inline] slabfree mm/slub.c:4299 [inline] kfree+0x105/0x340 mm/slub.c:4409 pvr2contextcheck drivers/media/usb/pvrusb2/pvrusb2-context.c:137 [inline] pvr2contextthreadfunc+0x69d/0x960 drivers/media/usb/pvrusb2/pvrusb2-context.c:158
[Analyze] Task A set disconnectflag = !0, which resulted in Task B's condition being met and releasing mp, leading to this issue.
[Fix] Place the disconnectflag assignment operation after all code in pvr2contextdisconnect() to avoid this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.57.1-5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.15.167.1-2 - Configuration
In drivers/media/usb/pvrusb2/pvrusb2-context.c, place the disconnect_flag assignment operation after all code in pvr2_context_disconnect() to avoid the slab-use-after-free in pvr2_context_set_notify.
Linux kernel: media/usb/pvrusb2 (pvrusb2-context.c) disconnect_flag assignment position in pvr2_context_disconnect() = Move disconnect_flag = !0 to after all code in pvr2_context_disconnect()
Event History
Frequently Asked Questions
What is CVE-2024-26875?
CVE-2024-26875 is a vulnerability in the Linux kernel affecting the pvrusb2 driver, specifically related to a use-after-free condition in the pvr2_context_set_notify function.
What is the severity of CVE-2024-26875?
The severity of CVE-2024-26875 has not been explicitly rated, but use-after-free vulnerabilities can potentially lead to system crashes or code execution.
How do I fix CVE-2024-26875?
To mitigate CVE-2024-26875, update your Linux kernel to versions 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.128-1, 6.12.12-1, or 6.12.13-1 as specified by your distribution.
Which affected software versions are related to CVE-2024-26875?
The affected software versions for CVE-2024-26875 include specific kernel releases like 5.10.223-1 and 6.12.13-1 from the Debian package linux.
How can I identify if my system is vulnerable to CVE-2024-26875?
You can check if your system is vulnerable to CVE-2024-26875 by verifying the kernel version running on your system against the affected versions.