CVE-2024-38630: watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger
In the Linux kernel, the following vulnerability has been resolved:
watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdttrigger
When the cpu5wdt module is removing, the origin code uses deltimer() to de-activate the timer. If the timer handler is running, deltimer() could not stop it and will return directly. If the port region is released by releaseregion() and then the timer handler cpu5wdttrigger() calls outb() to write into the region that is released, the use-after-free bug will happen.
Change deltimer() to timershutdownsync() in order that the timer handler could be finished before the port region is released.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38630?
CVE-2024-38630 is categorized as a high severity vulnerability due to the potential for a use-after-free condition in the Linux kernel.
How do I fix CVE-2024-38630?
To address CVE-2024-38630, you should upgrade to the patched versions of the Linux kernel which include 6.12.10-1 or 6.12.11-1.
Which systems are affected by CVE-2024-38630?
CVE-2024-38630 affects specific versions of the Linux kernel between 3.8 and 6.6.33, as well as between 6.7 and 6.9.4.
What are the potential impacts of CVE-2024-38630?
Exploitation of CVE-2024-38630 could lead to crashes or execution of arbitrary code due to the use-after-free vulnerability.
Is CVE-2024-38630 already resolved?
Yes, CVE-2024-38630 has been resolved with patches provided in the newer versions of the Linux kernel.