CVE-2024-50073: tty: n_gsm: Fix use-after-free in gsm_cleanup_mux
In the Linux kernel, the following vulnerability has been resolved:
tty: ngsm: Fix use-after-free in gsmcleanupmux
BUG: KASAN: slab-use-after-free in gsmcleanupmux+0x77b/0x7b0 drivers/tty/ngsm.c:3160 [ngsm] Read of size 8 at addr ffff88815fe99c00 by task poc/3379 CPU: 0 UID: 0 PID: 3379 Comm: poc Not tainted 6.11.0+ #56 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 Call Trace: <TASK> gsmcleanupmux+0x77b/0x7b0 drivers/tty/ngsm.c:3160 [ngsm] pfxgsmcleanupmux+0x10/0x10 drivers/tty/ngsm.c:3124 [ngsm] pfxschedclockcpu+0x10/0x10 kernel/sched/clock.c:389 updateloadavg+0x1c1/0x27b0 kernel/sched/fair.c:4500 pfxminvruntimecbrotate+0x10/0x10 kernel/sched/fair.c:846 rbinsertaugmented+0x492/0xbf0 lib/rbtree.c:161 gsmldioctl+0x395/0x1450 drivers/tty/ngsm.c:3408 [ngsm] rawspinlockirqsave+0x92/0xf0 arch/x86/include/asm/atomic.h:107 pfxgsmldioctl+0x10/0x10 drivers/tty/ngsm.c:3822 [ngsm] ktimeget+0x5e/0x140 kernel/time/timekeeping.c:195 ldsemdownread+0x94/0x4e0 arch/x86/include/asm/atomic6464.h:79 pfxldsemdownread+0x10/0x10 drivers/tty/ttyldsem.c:338 pfxdovfsioctl+0x10/0x10 fs/ioctl.c:805 ttyioctl+0x643/0x1100 drivers/tty/ttyio.c:2818
Allocated by task 65: gsmdataalloc.constprop.0+0x27/0x190 drivers/tty/ngsm.c:926 [ngsm] gsmsend+0x2c/0x580 drivers/tty/ngsm.c:819 [ngsm] gsm1receive+0x547/0xad0 drivers/tty/ngsm.c:3038 [ngsm] gsmldreceivebuf+0x176/0x280 drivers/tty/ngsm.c:3609 [ngsm] ttyldiscreceivebuf+0x101/0x1e0 drivers/tty/ttybuffer.c:391 ttyportdefaultreceivebuf+0x61/0xa0 drivers/tty/ttyport.c:39 flushtoldisc+0x1b0/0x750 drivers/tty/ttybuffer.c:445 processscheduledworks+0x2b0/0x10d0 kernel/workqueue.c:3229 workerthread+0x3dc/0x950 kernel/workqueue.c:3391 kthread+0x2a3/0x370 kernel/kthread.c:389 retfromfork+0x2d/0x70 arch/x86/kernel/process.c:147 retfromforkasm+0x1a/0x30 arch/x86/entry/entry64.S:257
Freed by task 3367: kfree+0x126/0x420 mm/slub.c:4580 gsmcleanupmux+0x36c/0x7b0 drivers/tty/ngsm.c:3160 [ngsm] gsmldioctl+0x395/0x1450 drivers/tty/ngsm.c:3408 [ngsm] ttyioctl+0x643/0x1100 drivers/tty/ttyio.c:2818
[Analysis] gsmmsg on the txctrllist or txdatalist of gsmmux can be freed by multi threads through ioctl,which leads to the occurrence of uaf. Protect it by gsm tx lock.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.64.2-1 - Configuration
Apply the kernel fix described: protect gsm_cleanup_mux and the gsm_msg use across tx_ctrl_list/tx_data_list with the gsm tx lock to prevent the slab use-after-free reported in gsm_cleanup_mux.
Linux kernel n_gsm (drivers/tty/n_gsm.c) gsm_cleanup_mux: protect gsm_msg access with tx lock (gsm tx lock) = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50073?
CVE-2024-50073 has a moderate severity level due to the potential for a use-after-free vulnerability in the Linux kernel.
What software versions are affected by CVE-2024-50073?
CVE-2024-50073 affects various versions of the Linux kernel, specifically versions below 6.1.114 and between 6.2 and 6.11.5, as well as 6.12-rc1, 6.12-rc2, and 6.12-rc3.
How do I fix CVE-2024-50073?
To fix CVE-2024-50073, you should update your Linux kernel to a version above 6.1.114 or apply the relevant patch provided by the maintainers.
Can CVE-2024-50073 lead to system compromise?
Yes, CVE-2024-50073 can potentially lead to system compromise due to the use-after-free vulnerability allowing for arbitrary code execution.
What mitigations are recommended for CVE-2024-50073 until a patch is applied?
Until a patch is applied for CVE-2024-50073, it is recommended to restrict access to the affected systems and monitor for unusual activity.