CVE-2024-26893: firmware: arm_scmi: Fix double free in SMC transport cleanup path
In the Linux kernel, the following vulnerability has been resolved:
firmware: armscmi: Fix double free in SMC transport cleanup path
When the generic SCMI code tears down a channel, it calls the chanfree callback function, defined by each transport. Since multiple protocols might share the same transportinfo member, chanfree() might want to clean up the same member multiple times within the given SCMI transport implementation. In this case, it is SMC transport. This will lead to a NULL pointer dereference at the second time:
| scmiprotocol scmidev.1: Enabled polling mode TX channel - protid:16 | arm-scmi firmware:scmi: SCMI Notifications - Core Enabled. | arm-scmi firmware:scmi: unable to communicate with SCMI | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 | Mem abort info: | ESR = 0x0000000096000004 | EC = 0x25: DABT (current EL), IL = 32 bits | SET = 0, FnV = 0 | EA = 0, S1PTW = 0 | FSC = 0x04: level 0 translation fault | Data abort info: | ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 | CM = 0, WnR = 0, TnD = 0, TagAccess = 0 | GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 | user pgtable: 4k pages, 48-bit VAs, pgdp=0000000881ef8000 | [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 | Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP | Modules linked in: | CPU: 4 PID: 1 Comm: swapper/0 Not tainted 6.7.0-rc2-00124-g455ef3d016c9-dirty #793 | Hardware name: FVP Base RevC (DT) | pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) | pc : smcchanfree+0x3c/0x6c | lr : smcchanfree+0x3c/0x6c | Call trace: | smcchanfree+0x3c/0x6c | idrforeach+0x68/0xf8 | scmicleanupchannels.isra.0+0x2c/0x58 | scmiprobe+0x434/0x734 | platformprobe+0x68/0xd8 | reallyprobe+0x110/0x27c | driverprobedevice+0x78/0x12c | driverprobedevice+0x3c/0x118 | driverattach+0x74/0x128 | busforeachdev+0x78/0xe0 | driverattach+0x24/0x30 | busadddriver+0xe4/0x1e8 | driverregister+0x60/0x128 | platformdriverregister+0x28/0x34 | scmidriverinit+0x84/0xc0 | dooneinitcall+0x78/0x33c | kernelinitfreeable+0x2b8/0x51c | kernelinit+0x24/0x130 | retfromfork+0x10/0x20 | Code: f0004701 910a0021 aa1403e5 97b91c70 (b9400280) | ---[ end trace 0000000000000000 ]---
Simply check for the struct pointer being NULL before trying to access its members, to avoid this situation.
This was found when a transport doesn't really work (for instance no SMC service), the probe routines then tries to clean up, and triggers a crash.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26893?
CVE-2024-26893 has a moderate severity rating due to the potential for resource leaks affecting system stability.
How do I fix CVE-2024-26893?
To fix CVE-2024-26893, update to the patched versions of the Linux kernel specified by your distribution.
Which versions are affected by CVE-2024-26893?
CVE-2024-26893 affects Linux kernel versions from 5.8 to 6.1.83, 6.2 to 6.6.23, 6.7 to 6.7.11, and 6.8 to 6.8.2.
What component of the Linux kernel is affected in CVE-2024-26893?
CVE-2024-26893 affects the ARM SCMI firmware transport cleanup path, leading to a double-free vulnerability.
When was CVE-2024-26893 disclosed?
CVE-2024-26893 was disclosed as a vulnerability in the Linux kernel and subsequently resolved in recent updates.