UBUNTU-CVE-2024-53068: Use After Free
In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Fix slab-use-after-free in scmibusnotifier() The scmidev->name is released prematurely in scmidevicedestroy(), which causes slab-use-after-free when accessing scmidev->name in scmibusnotifier(). So move the release of scmidev->name to scmidevicerelease() to avoid slab-use-after-free. | BUG: KASAN: slab-use-after-free in strncmp+0xe4/0xec | Read of size 1 at addr ffffff80a482bcc0 by task swapper/0/1 | | CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.6.38-debug #1 | Hardware name: Qualcomm Technologies, Inc. SA8775P Ride (DT) | Call trace: | dumpbacktrace+0x94/0x114 | showstack+0x18/0x24 | dumpstacklvl+0x48/0x60 | printreport+0xf4/0x5b0 | kasanreport+0xa4/0xec | asanreportload1noabort+0x20/0x2c | strncmp+0xe4/0xec | scmibusnotifier+0x5c/0x54c | notifiercallchain+0xb4/0x31c | blockingnotifiercallchain+0x68/0x9c | busnotify+0x54/0x78 | devicedel+0x1bc/0x840 | deviceunregister+0x20/0xb4 | scmidevicedestroy+0xac/0x280 | scmidevicedestroy+0x94/0xd0 | scmichansetup+0x524/0x750 | scmiprobe+0x7fc/0x1508 | platformprobe+0xc4/0x19c | reallyprobe+0x32c/0x99c | driverprobedevice+0x15c/0x3c4 | driverprobedevice+0x5c/0x170 | driverattach+0x1c8/0x440 | busforeachdev+0xf4/0x178 | driverattach+0x3c/0x58 | busadddriver+0x234/0x4d4 | driverregister+0xf4/0x3c0 | platformdriverregister+0x60/0x88 | scmidriverinit+0xb0/0x104 | dooneinitcall+0xb4/0x664 | kernelinitfreeable+0x3c8/0x894 | kernelinit+0x24/0x1e8 | retfromfork+0x10/0x20 | | Allocated by task 1: | kasansavestack+0x2c/0x54 | kasansettrack+0x2c/0x40 | kasansaveallocinfo+0x24/0x34 | kasankmalloc+0xa0/0xb8 | kmallocnodetrackcaller+0x6c/0x104 | kstrdup+0x48/0x84 | kstrdupconst+0x34/0x40 | scmidevicecreate.part.0+0x8c/0x408 | scmidevicecreate+0x104/0x370 | scmichansetup+0x2a0/0x750 | scmiprobe+0x7fc/0x1508 | platformprobe+0xc4/0x19c | reallyprobe+0x32c/0x99c | driverprobedevice+0x15c/0x3c4 | driverprobedevice+0x5c/0x170 | driverattach+0x1c8/0x440 | busforeachdev+0xf4/0x178 | driverattach+0x3c/0x58 | busadddriver+0x234/0x4d4 | driverregister+0xf4/0x3c0 | platformdriverregister+0x60/0x88 | scmidriverinit+0xb0/0x104 | dooneinitcall+0xb4/0x664 | kernelinitfreeable+0x3c8/0x894 | kernelinit+0x24/0x1e8 | retfromfork+0x10/0x20 | | Freed by task 1: | kasansavestack+0x2c/0x54 | kasansettrack+0x2c/0x40 | kasansavefreeinfo+0x38/0x5c | kasanslabfree+0xe8/0x164 | kmemcachefree+0x11c/0x230 | kfree+0x70/0x130 | kfreeconst+0x20/0x40 | scmidevicedestroy+0x70/0x280 | scmidevicedestroy+0x94/0xd0 | scmichansetup+0x524/0x750 | scmiprobe+0x7fc/0x1508 | platformprobe+0xc4/0x19c | reallyprobe+0x32c/0x99c | driverprobedevice+0x15c/0x3c4 | driverprobedevice+0x5c/0x170 | driverattach+0x1c8/0x440 | busforeachdev+0xf4/0x178 | driverattach+0x3c/0x58 | busadddriver+0x234/0x4d4 | driverregister+0xf4/0x3c0 | platformdriverregister+0x60/0x88 | scmidriverinit+0xb0/0x104 | dooneinitcall+0xb4/0x664 | kernelinitfreeable+0x3c8/0x894 | kernelinit+0x24/0x1e8 | retfromfork+0x10/0x20
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1097.104~20.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1102.111~20.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1097.106~20.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-163.173~20.04.1 - Upgrade
Upgrade
ubuntu/linux-ibm-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1091.94~20.04.1 - Upgrade
Upgrade
ubuntu/linux-intel-iotg-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1092.98~20.04.1 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-163.173~20.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegra-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1049.49~20.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1094.100~20.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1092.96~20.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 5.15.0-163.173 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 5.15.0-1097.104 - Upgrade
Upgrade
ubuntu/linux-aws-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1027.29~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 5.15.0-1101.110 - Upgrade
Upgrade
ubuntu/linux-azure-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1027.32~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 5.15.0-1102.111.1 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 5.15.0-1097.106 - Upgrade
Upgrade
ubuntu/linux-gcp-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1028.30~22.04.1 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 5.15.0-1093.99 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 5.15.0-1080.88 - Upgrade
Upgrade
ubuntu/linux-hwe-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-58.60~22.04.1 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 5.15.0-1091.94 - Upgrade
Upgrade
ubuntu/linux-ibm-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1024.24~22.04.1 - Upgrade
Upgrade
ubuntu/linux-intel-iotgto a version that resolves this vulnerability.Fixed in 5.15.0-1092.98 - Upgrade
Upgrade
ubuntu/linux-kvmto a version that resolves this vulnerability.Fixed in 5.15.0-1089.94 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 5.15.0-163.173 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-58.60.1~22.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 5.15.0-1092.93 - Upgrade
Upgrade
ubuntu/linux-nvidia-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1026.29~22.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 5.15.0-1049.49 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegra-igxto a version that resolves this vulnerability.Fixed in 5.15.0-1038.38 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 5.15.0-1094.100 - Upgrade
Upgrade
ubuntu/linux-oracle-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1024.25~22.04.1 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 5.15.0-1091.94 - Upgrade
Upgrade
ubuntu/linux-riscv-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-58.60.1~22.04.1 - Upgrade
Upgrade
ubuntu/linux-xilinx-zynqmpto a version that resolves this vulnerability.Fixed in 5.15.0-1061.65 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 5.15.0-1081.83 - Upgrade
Upgrade
ubuntu/linux-intel-iot-realtimeto a version that resolves this vulnerability.Fixed in 5.15.0-1089.91 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 5.15.0-1096.105 - Upgrade
Upgrade
ubuntu/linux-realtime-6.8to a version that resolves this vulnerability.Fixed in 6.8.1-1020.21~22.04.1 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1097.104+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1101.110+fips1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-163.173+fips1 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1097.106+fips1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 6.8.0-58.60 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 6.8.0-1027.29 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 6.8.0-1027.32 - Upgrade
Upgrade
ubuntu/linux-azure-6.11to a version that resolves this vulnerability.Fixed in 6.11.0-1012.12~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-nvidiato a version that resolves this vulnerability.Fixed in 6.8.0-1014.15 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 6.8.0-1028.30 - Upgrade
Upgrade
ubuntu/linux-gcp-6.11to a version that resolves this vulnerability.Fixed in 6.11.0-1011.11~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 6.8.0-1023.27 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 6.8.0-1010.12 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 6.8.0-1024.24 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-58.60.1 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 6.8.0-1026.29 - Upgrade
Upgrade
ubuntu/linux-nvidia-6.11to a version that resolves this vulnerability.Fixed in 6.11.0-1007.7 - Upgrade
Upgrade
ubuntu/linux-nvidia-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-1026.29.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1008.8 - Upgrade
Upgrade
ubuntu/linux-oem-6.11to a version that resolves this vulnerability.Fixed in 6.11.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oem-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1026.26 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 6.8.0-1024.25 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 6.8.0-1028.32 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 6.8.0-58.60.1 - Upgrade
Upgrade
ubuntu/linux-xilinxto a version that resolves this vulnerability.Fixed in 6.8.0-1017.18 - Upgrade
Upgrade
ubuntu/linux-raspi-realtimeto a version that resolves this vulnerability.Fixed in 6.8.0-2023.24 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 6.8.1-1020.21 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-78.78+fips1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running one of the listed Ubuntu kernel packages may be affected: linux-realtime, linux-azure, linux-gcp, linux-gke, linux-gkeop, linux-riscv, linux-fips, or linux-azure-fde. The issue is in the Linux kernel ARM SCMI firmware driver path.
What access does an attacker need to exploit this vulnerability?
The supplied severity vector indicates local access, low attack complexity, low privileges, and no user interaction are required. It also indicates potential high impact to confidentiality, integrity, and availability.
How can administrators recognize the issue in diagnostics?
A vulnerable system may report a KASAN slab-use-after-free involving strncmp and scmi_bus_notifier(). The provided trace shows it during SCMI device destruction and setup, including __scmi_device_destroy(), scmi_device_destroy(), scmi_chan_setup(), and scmi_probe().
What code change resolves the use-after-free?
The fix moves release of scmi_dev->name from __scmi_device_destroy() to scmi_device_release(). This prevents scmi_bus_notifier() from accessing the device name after it has been freed.