CVE-2024-38385: genirq/irqdesc: Prevent use-after-free in irq_find_at_or_after()
In the Linux kernel, the following vulnerability has been resolved:
genirq/irqdesc: Prevent use-after-free in irqfindatorafter()
irqfindatorafter() dereferences the interrupt descriptor which is returned by mtfind() while neither holding sparseirqlock nor RCU read lock, which means the descriptor can be freed between mtfind() and the dereference:
CPU0 CPU1 desc = mtfind() delayedfreedesc(desc) irqdescgetirq(desc)
The use-after-free is reported by KASAN:
Call trace: irqgetnextirq+0x58/0x84 showstat+0x638/0x824 seqreaditer+0x158/0x4ec procregreaditer+0x94/0x12c vfsread+0x1e0/0x2c8
Freed by task 4471: slabfreefreelisthook+0x174/0x1e0 kmemcachefree+0xa4/0x1dc kfree+0x64/0x128 irqkobjrelease+0x28/0x3c kobjectput+0xcc/0x1e0 delayedfreedesc+0x14/0x2c rcudobatch+0x214/0x720
Guard the access with a RCU read lock section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38385?
CVE-2024-38385 has been classified as a medium severity vulnerability.
Which versions of the Linux kernel are affected by CVE-2024-38385?
CVE-2024-38385 affects Linux kernel versions between 6.5 and 6.6.34, and between 6.7 and 6.9.5.
How do I fix CVE-2024-38385?
To fix CVE-2024-38385, update your Linux kernel to the latest version or apply the relevant patches provided by your distribution.
What type of vulnerability is CVE-2024-38385?
CVE-2024-38385 is a use-after-free vulnerability in the Linux kernel.
What is the impact of CVE-2024-38385?
The impact of CVE-2024-38385 can lead to potential system instability and exploitation opportunities for attackers.