CVE-2024-50059: ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition
In the Linux kernel, the following vulnerability has been resolved:
ntb: ntbhwswitchtec: Fix use after free vulnerability in switchtecntbremove due to race condition
In the switchtecntbadd function, it can call switchtecntbinitsndev function, then &sndev->checklinkstatuswork is bound with checklinkstatuswork. switchtecntblinknotification may be called to start the work.
If we remove the module which will call switchtecntbremove to make cleanup, it will free sndev through kfree(sndev), while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows:
CPU0 CPU1
| checklinkstatuswork switchtecntbremove | kfree(sndev); | | if (sndev->linkforcedown) | // use sndev
Fix it by ensuring that the work is canceled before proceeding with the cleanup in switchtecntbremove.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50059?
The severity of CVE-2024-50059 is considered high due to the potential for a use-after-free vulnerability leading to system instability or exploitation.
How do I fix CVE-2024-50059?
To fix CVE-2024-50059, you should update to a patched version of the Linux kernel, specifically versions 6.1.123-1, 6.1.128-1, 6.12.12-1, or 6.12.15-1.
Which versions of the Linux kernel are affected by CVE-2024-50059?
CVE-2024-50059 affects Linux kernel versions from 5.10.0 up to 6.11.4, excluding later patches.
What is a use-after-free vulnerability as seen in CVE-2024-50059?
A use-after-free vulnerability occurs when a program continues to use a memory location after it has been freed, potentially leading to crashes or arbitrary code execution.
Is CVE-2024-50059 specific to certain Linux distributions?
CVE-2024-50059 impacts the Linux kernel across various distributions that use affected versions, not being limited to a specific distribution.