UBUNTU-CVE-2024-50073: Use After Free

Q: What access does an attacker need to exploit this issue?

The provided severity vector indicates local access, low privileges, no user interaction, high attack complexity, and an additional attack prerequisite. The affected component is the n_gsm TTY line discipline.

Q: Which Ubuntu kernel package families are listed as affected?

The listed software includes ubuntu/linux, ubuntu/linux-fips, ubuntu/linux-aws, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-aws-fips, ubuntu/linux-azure-fips, and ubuntu/linux-gcp-fips.

Q: What evidence may indicate that a system has encountered this vulnerability?

The reported failure is a KASAN slab use-after-free in gsm_cleanup_mux in drivers/tty/n_gsm.c, reached through gsmld_ioctl. Kernel logs or crash reports containing these function names may indicate exposure to the issue.

Published Oct 29, 2024

Updated

In the Linux kernel, the following vulnerability has been resolved: tty: ngsm: Fix use-after-free in gsmcleanupmux BUG: KASAN: slab-use-after-free in gsmcleanupmux+0x77b/0x7b0 drivers/tty/ngsm.c:3160 [ngsm] Read of size 8 at addr ffff88815fe99c00 by task poc/3379 CPU: 0 UID: 0 PID: 3379 Comm: poc Not tainted 6.11.0+ #56 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 Call Trace: <TASK> gsmcleanupmux+0x77b/0x7b0 drivers/tty/ngsm.c:3160 [ngsm] pfxgsmcleanupmux+0x10/0x10 drivers/tty/ngsm.c:3124 [ngsm] pfxschedclockcpu+0x10/0x10 kernel/sched/clock.c:389 updateloadavg+0x1c1/0x27b0 kernel/sched/fair.c:4500 pfxminvruntimecbrotate+0x10/0x10 kernel/sched/fair.c:846 rbinsertaugmented+0x492/0xbf0 lib/rbtree.c:161 gsmldioctl+0x395/0x1450 drivers/tty/ngsm.c:3408 [ngsm] rawspinlockirqsave+0x92/0xf0 arch/x86/include/asm/atomic.h:107 pfxgsmldioctl+0x10/0x10 drivers/tty/ngsm.c:3822 [ngsm] ktimeget+0x5e/0x140 kernel/time/timekeeping.c:195 ldsemdownread+0x94/0x4e0 arch/x86/include/asm/atomic6464.h:79 pfxldsemdownread+0x10/0x10 drivers/tty/ttyldsem.c:338 pfxdovfsioctl+0x10/0x10 fs/ioctl.c:805 ttyioctl+0x643/0x1100 drivers/tty/ttyio.c:2818 Allocated by task 65: gsmdataalloc.constprop.0+0x27/0x190 drivers/tty/ngsm.c:926 [ngsm] gsmsend+0x2c/0x580 drivers/tty/ngsm.c:819 [ngsm] gsm1receive+0x547/0xad0 drivers/tty/ngsm.c:3038 [ngsm] gsmldreceivebuf+0x176/0x280 drivers/tty/ngsm.c:3609 [ngsm] ttyldiscreceivebuf+0x101/0x1e0 drivers/tty/ttybuffer.c:391 ttyportdefaultreceivebuf+0x61/0xa0 drivers/tty/ttyport.c:39 flushtoldisc+0x1b0/0x750 drivers/tty/ttybuffer.c:445 processscheduledworks+0x2b0/0x10d0 kernel/workqueue.c:3229 workerthread+0x3dc/0x950 kernel/workqueue.c:3391 kthread+0x2a3/0x370 kernel/kthread.c:389 retfromfork+0x2d/0x70 arch/x86/kernel/process.c:147 retfromforkasm+0x1a/0x30 arch/x86/entry/entry64.S:257 Freed by task 3367: kfree+0x126/0x420 mm/slub.c:4580 gsmcleanupmux+0x36c/0x7b0 drivers/tty/ngsm.c:3160 [ngsm] gsmldioctl+0x395/0x1450 drivers/tty/ngsm.c:3408 [ngsm] ttyioctl+0x643/0x1100 drivers/tty/ttyio.c:2818 [Analysis] gsmmsg on the txctrllist or txdatalist of gsmmux can be freed by multi threads through ioctl,which leads to the occurrence of uaf. Protect it by gsm tx lock.

Affected Software

205 affected componentsFixes available

ubuntu/linux*

ubuntu/linux-aws<4.4.0-1146.152

4.4.0-1146.152

ubuntu/linux-azure<4.15.0-1191.206~14.04.1

4.15.0-1191.206~14.04.1

ubuntu/linux-lts-xenial<4.4.0-271.305~14.04.1

4.4.0-271.305~14.04.1

ubuntu/linux<4.4.0-271.305

4.4.0-271.305

ubuntu/linux-aws<4.4.0-1184.199

4.4.0-1184.199

ubuntu/linux-aws-hwe<4.15.0-1183.196~16.04.1

4.15.0-1183.196~16.04.1

ubuntu/linux-azure<4.15.0-1191.206~16.04.1

4.15.0-1191.206~16.04.1

ubuntu/linux-gcp<4.15.0-1176.193~16.04.1

4.15.0-1176.193~16.04.1

ubuntu/linux-hwe<4.15.0-240.252~16.04.1

4.15.0-240.252~16.04.1

ubuntu/linux-kvm<4.4.0-1147.158

4.4.0-1147.158

ubuntu/linux-oracle<4.15.0-1145.156~16.04.1

4.15.0-1145.156~16.04.1

ubuntu/linux-hwe-edge*

ubuntu/linux-fips<4.4.0-1116.123

4.4.0-1116.123

ubuntu/linux-fips*

ubuntu/linux<4.15.0-240.252

4.15.0-240.252

ubuntu/linux-aws<4.15.0-1183.196

4.15.0-1183.196

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-aws-5.4<5.4.0-1149.159~18.04.1

5.4.0-1149.159~18.04.1

ubuntu/linux-azure*

ubuntu/linux-azure-4.15<4.15.0-1191.206

4.15.0-1191.206

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-5.4<5.4.0-1154.161~18.04.1

5.4.0-1154.161~18.04.1

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-4.15<4.15.0-1176.193

4.15.0-1176.193

ubuntu/linux-gcp-5.3*

ubuntu/linux-gcp-5.4<5.4.0-1152.161~18.04.1

5.4.0-1152.161~18.04.1

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-5.4<5.4.0-220.240~18.04.1

5.4.0-220.240~18.04.1

ubuntu/linux-hwe-edge*

ubuntu/linux-ibm-5.4<5.4.0-1095.100~18.04.1

5.4.0-1095.100~18.04.1

ubuntu/linux-kvm<4.15.0-1166.171

4.15.0-1166.171

ubuntu/linux-oem*

ubuntu/linux-oracle<4.15.0-1145.156

4.15.0-1145.156

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-oracle-5.4<5.4.0-1148.158~18.04.1

5.4.0-1148.158~18.04.1

ubuntu/linux-raspi-5.4<5.4.0-1132.145~18.04.1

5.4.0-1132.145~18.04.1

ubuntu/linux-aws-fips<4.15.0-2121.127

4.15.0-2121.127

ubuntu/linux-azure-fips<4.15.0-2100.106

4.15.0-2100.106

ubuntu/linux-fips<4.15.0-1138.149

4.15.0-1138.149

ubuntu/linux-gcp-fips<4.15.0-2084.90

4.15.0-2084.90

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<5.4.0-220.240

5.4.0-220.240

ubuntu/linux-aws<5.4.0-1149.159

5.4.0-1149.159

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.15<5.15.0-1089.96~20.04.1

5.15.0-1089.96~20.04.1

ubuntu/linux-aws-5.8*

ubuntu/linux-azure<5.4.0-1154.161

5.4.0-1154.161

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.15<5.15.0-1094.103~20.04.1

5.15.0-1094.103~20.04.1

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-bluefield<5.4.0-1108.115

5.4.0-1108.115

ubuntu/linux-gcp<5.4.0-1152.161

5.4.0-1152.161

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.15<5.15.0-1088.97~20.04.1

5.15.0-1088.97~20.04.1

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.15<5.15.0-145.158~20.04.1

5.15.0-145.158~20.04.1

ubuntu/linux-hwe-5.8*

ubuntu/linux-ibm<5.4.0-1095.100

5.4.0-1095.100

ubuntu/linux-ibm-5.15<5.15.0-1081.84~20.04.1

5.15.0-1081.84~20.04.1

ubuntu/linux-intel-5.13*

ubuntu/linux-intel-iotg-5.15<5.15.0-1084.90~20.04.1

5.15.0-1084.90~20.04.1

ubuntu/linux-iot<5.4.0-1053.56

5.4.0-1053.56

ubuntu/linux-kvm<5.4.0-1136.145

5.4.0-1136.145

ubuntu/linux-lowlatency-hwe-5.15<5.15.0-145.158~20.04.1

5.15.0-145.158~20.04.1

ubuntu/linux-nvidia-tegra-5.15<5.15.0-1042.42~20.04.1

5.15.0-1042.42~20.04.1

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle<5.4.0-1147.157

5.4.0-1147.157

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.15<5.15.0-1086.92~20.04.1

5.15.0-1086.92~20.04.1

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi<5.4.0-1132.145

5.4.0-1132.145

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.15<5.15.0-1084.88~20.04.1

5.15.0-1084.88~20.04.1

ubuntu/linux-riscv-5.8*

ubuntu/linux-xilinx-zynqmp<5.4.0-1067.71

5.4.0-1067.71

ubuntu/linux-aws-fips<5.4.0-1149.159+fips1

5.4.0-1149.159+fips1

ubuntu/linux-azure-fips<5.4.0-1155.162+fips1

5.4.0-1155.162+fips1

ubuntu/linux-fips<5.4.0-1123.133

5.4.0-1123.133

ubuntu/linux-gcp-fips<5.4.0-1152.161+fips1

5.4.0-1152.161+fips1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<5.15.0-151.161

5.15.0-151.161

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws<5.15.0-1089.96

5.15.0-1089.96

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8<6.8.0-1027.29~22.04.1

6.8.0-1027.29~22.04.1

ubuntu/linux-azure<5.15.0-1094.103

5.15.0-1094.103

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8<6.8.0-1025.30~22.04.1

6.8.0-1025.30~22.04.1

ubuntu/linux-azure-fde<5.15.0-1094.103.1

5.15.0-1094.103.1

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp<5.15.0-1088.97

5.15.0-1088.97

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gcp-6.8<6.8.0-1026.28~22.04.1

6.8.0-1026.28~22.04.1

ubuntu/linux-gke<5.15.0-1086.92

5.15.0-1086.92

ubuntu/linux-gkeop<5.15.0-1071.79

5.15.0-1071.79

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-hwe-6.8<6.8.0-57.59~22.04.1

6.8.0-57.59~22.04.1

ubuntu/linux-ibm<5.15.0-1081.84

5.15.0-1081.84

ubuntu/linux-ibm-6.8<6.8.0-1023.23~22.04.1

6.8.0-1023.23~22.04.1

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-intel-iotg<5.15.0-1084.90

5.15.0-1084.90

ubuntu/linux-kvm<5.15.0-1085.90

5.15.0-1085.90

ubuntu/linux-lowlatency<5.15.0-145.158

5.15.0-145.158

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-lowlatency-hwe-6.8<6.8.0-56.58.1~22.04.1

6.8.0-56.58.1~22.04.1

ubuntu/linux-nvidia<5.15.0-1083.84

5.15.0-1083.84

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8<6.8.0-1024.27~22.04.1

6.8.0-1024.27~22.04.1

ubuntu/linux-nvidia-tegra<5.15.0-1042.42

5.15.0-1042.42

ubuntu/linux-nvidia-tegra-igx<5.15.0-1031.31

5.15.0-1031.31

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle<5.15.0-1086.92

5.15.0-1086.92

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8<6.8.0-1022.23~22.04.1

6.8.0-1022.23~22.04.1

ubuntu/linux-raspi<5.15.0-1083.86

5.15.0-1083.86

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-riscv-6.8<6.8.0-56.58.1~22.04.1

6.8.0-56.58.1~22.04.1

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-xilinx-zynqmp<5.15.0-1053.57

5.15.0-1053.57

ubuntu/linux-bluefield<5.15.0-1072.74

5.15.0-1072.74

ubuntu/linux-intel-iot-realtime<5.15.0-1082.84

5.15.0-1082.84

ubuntu/linux-realtime<5.15.0-1089.98

5.15.0-1089.98

ubuntu/linux-realtime-6.8<6.8.1-1018.19~22.04.1

6.8.1-1018.19~22.04.1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips<5.15.0-1089.96+fips1

5.15.0-1089.96+fips1

ubuntu/linux-azure-fips<5.15.0-1094.103+fips1

5.15.0-1094.103+fips1

ubuntu/linux-fips<5.15.0-145.158+fips1

5.15.0-145.158+fips1

ubuntu/linux-gcp-fips<5.15.0-1088.97+fips1

5.15.0-1088.97+fips1

ubuntu/linux<6.8.0-56.58

6.8.0-56.58

ubuntu/linux-aws<6.8.0-1025.27

6.8.0-1025.27

ubuntu/linux-azure<6.8.0-1025.30

6.8.0-1025.30

ubuntu/linux-azure-6.11<6.11.0-1012.12~24.04.1

6.11.0-1012.12~24.04.1

ubuntu/linux-azure-nvidia<6.8.0-1014.15

6.8.0-1014.15

ubuntu/linux-gcp<6.8.0-1026.28

6.8.0-1026.28

ubuntu/linux-gcp-6.11<6.11.0-1011.11~24.04.1

6.11.0-1011.11~24.04.1

ubuntu/linux-gke<6.8.0-1021.25

6.8.0-1021.25

ubuntu/linux-gkeop<6.8.0-1008.10

6.8.0-1008.10

ubuntu/linux-ibm<6.8.0-1022.22

6.8.0-1022.22

ubuntu/linux-lowlatency<6.8.0-56.58.1

6.8.0-56.58.1

ubuntu/linux-nvidia<6.8.0-1024.27

6.8.0-1024.27

ubuntu/linux-nvidia-6.11<6.11.0-1007.7

6.11.0-1007.7

ubuntu/linux-nvidia-lowlatency<6.8.0-1024.27.1

6.8.0-1024.27.1

ubuntu/linux-nvidia-tegra<6.8.0-1004.4

6.8.0-1004.4

ubuntu/linux-oem-6.11<6.11.0-1015.15

6.11.0-1015.15

ubuntu/linux-oem-6.8<6.8.0-1024.24

6.8.0-1024.24

ubuntu/linux-oracle<6.8.0-1022.23

6.8.0-1022.23

ubuntu/linux-raspi<6.8.0-1028.32

6.8.0-1028.32

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv<6.8.0-56.58.1

6.8.0-56.58.1

ubuntu/linux-xilinx<6.8.0-1017.18

6.8.0-1017.18

ubuntu/linux-raspi-realtime<6.8.0-2023.24

6.8.0-2023.24

ubuntu/linux-realtime<6.8.1-1018.19

6.8.1-1018.19

ubuntu/linux-fips<6.8.0-78.78+fips1

6.8.0-78.78+fips1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.4.0-1146.152
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.15.0-1191.206~14.04.1
Upgrade
Upgrade ubuntu/linux-lts-xenial to a version that resolves this vulnerability.
Fixed in 4.4.0-271.305~14.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 4.4.0-271.305
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.4.0-1184.199
Upgrade
Upgrade ubuntu/linux-aws-hwe to a version that resolves this vulnerability.
Fixed in 4.15.0-1183.196~16.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.15.0-1191.206~16.04.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 4.15.0-1176.193~16.04.1
Upgrade
Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.
Fixed in 4.15.0-240.252~16.04.1
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 4.4.0-1147.158
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 4.15.0-1145.156~16.04.1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 4.4.0-1116.123
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 4.15.0-240.252
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.15.0-1183.196
Upgrade
Upgrade ubuntu/linux-aws-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1149.159~18.04.1
Upgrade
Upgrade ubuntu/linux-azure-4.15 to a version that resolves this vulnerability.
Fixed in 4.15.0-1191.206
Upgrade
Upgrade ubuntu/linux-azure-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1154.161~18.04.1
Upgrade
Upgrade ubuntu/linux-gcp-4.15 to a version that resolves this vulnerability.
Fixed in 4.15.0-1176.193
Upgrade
Upgrade ubuntu/linux-gcp-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1152.161~18.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-220.240~18.04.1
Upgrade
Upgrade ubuntu/linux-ibm-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1095.100~18.04.1
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 4.15.0-1166.171
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 4.15.0-1145.156
Upgrade
Upgrade ubuntu/linux-oracle-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1148.158~18.04.1
Upgrade
Upgrade ubuntu/linux-raspi-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1132.145~18.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2121.127
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2100.106
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-1138.149
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2084.90
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.4.0-220.240
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.4.0-1149.159
Upgrade
Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1089.96~20.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.4.0-1154.161
Upgrade
Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1094.103~20.04.1
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.4.0-1108.115
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.4.0-1152.161
Upgrade
Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1088.97~20.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-145.158~20.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.4.0-1095.100
Upgrade
Upgrade ubuntu/linux-ibm-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1081.84~20.04.1
Upgrade
Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1084.90~20.04.1
Upgrade
Upgrade ubuntu/linux-iot to a version that resolves this vulnerability.
Fixed in 5.4.0-1053.56
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.4.0-1136.145
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-145.158~20.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1042.42~20.04.1
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.4.0-1147.157
Upgrade
Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1086.92~20.04.1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.4.0-1132.145
Upgrade
Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1084.88~20.04.1
Upgrade
Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.
Fixed in 5.4.0-1067.71
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1149.159+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1155.162+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1123.133
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1152.161+fips1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.15.0-151.161
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.15.0-1089.96
Upgrade
Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1027.29~22.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.15.0-1094.103
Upgrade
Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1025.30~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 5.15.0-1094.103.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.15.0-1088.97
Upgrade
Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1026.28~22.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 5.15.0-1086.92
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 5.15.0-1071.79
Upgrade
Upgrade ubuntu/linux-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-57.59~22.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.15.0-1081.84
Upgrade
Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1023.23~22.04.1
Upgrade
Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.
Fixed in 5.15.0-1084.90
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.15.0-1085.90
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 5.15.0-145.158
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-56.58.1~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 5.15.0-1083.84
Upgrade
Upgrade ubuntu/linux-nvidia-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1024.27~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 5.15.0-1042.42
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-igx to a version that resolves this vulnerability.
Fixed in 5.15.0-1031.31
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.15.0-1086.92
Upgrade
Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1022.23~22.04.1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.15.0-1083.86
Upgrade
Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-56.58.1~22.04.1
Upgrade
Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.
Fixed in 5.15.0-1053.57
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.15.0-1072.74
Upgrade
Upgrade ubuntu/linux-intel-iot-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1082.84
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1089.98
Upgrade
Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.1-1018.19~22.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1089.96+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1094.103+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-145.158+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1088.97+fips1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.8.0-56.58
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 6.8.0-1025.27
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 6.8.0-1025.30
Upgrade
Upgrade ubuntu/linux-azure-6.11 to a version that resolves this vulnerability.
Fixed in 6.11.0-1012.12~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1014.15
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 6.8.0-1026.28
Upgrade
Upgrade ubuntu/linux-gcp-6.11 to a version that resolves this vulnerability.
Fixed in 6.11.0-1011.11~24.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 6.8.0-1021.25
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 6.8.0-1008.10
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 6.8.0-1022.22
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-56.58.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1024.27
Upgrade
Upgrade ubuntu/linux-nvidia-6.11 to a version that resolves this vulnerability.
Fixed in 6.11.0-1007.7
Upgrade
Upgrade ubuntu/linux-nvidia-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-1024.27.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 6.8.0-1004.4
Upgrade
Upgrade ubuntu/linux-oem-6.11 to a version that resolves this vulnerability.
Fixed in 6.11.0-1015.15
Upgrade
Upgrade ubuntu/linux-oem-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1024.24
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 6.8.0-1022.23
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.8.0-1028.32
Upgrade
Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.
Fixed in 6.8.0-56.58.1
Upgrade
Upgrade ubuntu/linux-xilinx to a version that resolves this vulnerability.
Fixed in 6.8.0-1017.18
Upgrade
Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.
Fixed in 6.8.0-2023.24
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.8.1-1018.19
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-78.78+fips1
Compensating control
Protect access to gsm_msg entries on the gsm_mux tx_ctrl_list and tx_data_list with the GSM transmit lock (gsm tx lock) to prevent concurrent ioctl paths from freeing them while they are in use.

Event History

Oct 29, 2024

CVE Published

via OSV·01:15 AM

Data Sourced

via OSV·01:15 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The provided severity vector indicates local access, low privileges, no user interaction, high attack complexity, and an additional attack prerequisite. The affected component is the n_gsm TTY line discipline.

Which Ubuntu kernel package families are listed as affected?

The listed software includes ubuntu/linux, ubuntu/linux-fips, ubuntu/linux-aws, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-aws-fips, ubuntu/linux-azure-fips, and ubuntu/linux-gcp-fips.

What evidence may indicate that a system has encountered this vulnerability?

The reported failure is a KASAN slab use-after-free in gsm_cleanup_mux in drivers/tty/n_gsm.c, reached through gsmld_ioctl. Kernel logs or crash reports containing these function names may indicate exposure to the issue.

UBUNTU-CVE-2024-50073: Use After Free

Affected Software

Remediation

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which Ubuntu kernel package families are listed as affected?

What evidence may indicate that a system has encountered this vulnerability?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which Ubuntu kernel package families are listed as affected?

What evidence may indicate that a system has encountered this vulnerability?