CVE-2024-49986: platform/x86: x86-android-tablets: Fix use after free on platform_device_register() errors
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: x86-android-tablets: Fix use after free on platformdeviceregister() errors
x86androidtabletremove() frees the pdevs[] array, so it should not be used after calling x86androidtabletremove().
When platformdeviceregister() fails, store the pdevs[x] PTRERR() value into the local ret variable before calling x86androidtabletremove() to avoid using pdevs[] after it has been freed.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Configuration
In the platform/x86 x86-android-tablets code, when platform_device_register() fails, capture the pdevs[x] PTR_ERR() return value into the local ret variable before calling x86_android_tablet_remove(), to avoid using pdevs[] after it has been freed.
Linux kernel (platform/x86: x86-android-tablets) Error handling for platform_device_register() failure path = Store pdevs[x] PTR_ERR() into local ret variable before calling x86_android_tablet_remove()
Event History
Frequently Asked Questions
What is the severity of CVE-2024-49986?
CVE-2024-49986 has a medium severity rating as it involves a use after free condition that can potentially lead to system instability.
How do I fix CVE-2024-49986?
To mitigate CVE-2024-49986, update the Linux kernel to a version that includes the patch for this vulnerability.
Which versions of the Linux kernel are affected by CVE-2024-49986?
CVE-2024-49986 affects Linux kernel versions between 5.17 and 6.6.55, 6.7 and 6.10.14, and 6.11 and 6.11.3, along with the version 6.12-rc1.
What does CVE-2024-49986 involve?
CVE-2024-49986 involves a use after free vulnerability in the x86-android-tablets platform implementation of the Linux kernel.
Can CVE-2024-49986 be exploited remotely?
CVE-2024-49986 primarily affects system stability rather than being a remotely exploitable vulnerability.