In the Linux kernel, the following vulnerability has been resolved:
fbdev: pxafb: Fix possible use after free in pxafb_task()
In the pxafbprobe function, it calls the pxafbinitfbinfo function, after which &fbi->task is associated with pxafbtask. Moreover, within this pxafbinitfbinfo function, the pxafbblank function within the &pxafbops struct is capable of scheduling work.
If we remove the module which will call pxafbremove to make cleanup, it will call unregisterframebuffer function which can call dounregisterframebuffer to free fbi->fb through putfbinfo(fb_info), while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows:
CPU0 CPU1
| pxafb_task
pxafbremove | unregisterframebuffer(info) | dounregisterframebuffer(fbinfo) | putfbinfo(fbinfo) | // free fbi->fb | setctrlrstate(fbi, state) | _pxafblcdpower(fbi, 0) | fbi->lcdpower(on, &fbi->fb.var) | //use fbi->fb
Fix it by ensuring that the work is canceled before proceeding with the cleanup in pxafb_remove.
Note that only root user can remove the driver at runtime.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3a855764dbacbdb1cc51e15dc588f2d21c93e0e",
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2024-49924-11892230",
"target": {
"file": "drivers/video/fbdev/pxafb.c"
},
"digest": {
"line_hashes": [
"331231768851057453949700514902687751050",
"301499348710316175147440733004892977133",
"172585794260191973349832602893698594297",
"236562926645389460941662701024084863069"
],
"threshold": 0.9
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e657fa2df4429f3805a9b3e47fb1a4a1b02a72bd",
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2024-49924-11aab265",
"target": {
"file": "drivers/video/fbdev/pxafb.c"
},
"digest": {
"line_hashes": [
"53303589229588408865558194745966247125",
"28396638306077995074507612864658352081",
"172585794260191973349832602893698594297",
"236562926645389460941662701024084863069"
],
"threshold": 0.9
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4cda484e584be34d55ee17436ebf7ad11922b97a",
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2024-49924-23eafe86",
"target": {
"function": "pxafb_remove",
"file": "drivers/video/fbdev/pxafb.c"
},
"digest": {
"length": 420.0,
"function_hash": "302159975033061748069192567740747387449"
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6d0a07f68b66269e167def6c0b90a219cd3e7473",
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2024-49924-2dbdf894",
"target": {
"function": "pxafb_remove",
"file": "drivers/video/fbdev/pxafb.c"
},
"digest": {
"length": 420.0,
"function_hash": "302159975033061748069192567740747387449"
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c0d416eb4bef705f699213cee94bf54b6acdacd",
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2024-49924-30ef5d69",
"target": {
"function": "pxafb_remove",
"file": "drivers/video/fbdev/pxafb.c"
},
"digest": {
"length": 420.0,
"function_hash": "302159975033061748069192567740747387449"
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fdda354f60a576d52dcf90351254714681df4370",
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2024-49924-318160b4",
"target": {
"function": "pxafb_remove",
"file": "drivers/video/fbdev/pxafb.c"
},
"digest": {
"length": 407.0,
"function_hash": "48188582130387515049648668173492439564"
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aaadc0cb05c999ccd8898a03298b7e5c31509b08",
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2024-49924-3a0acbc9",
"target": {
"file": "drivers/video/fbdev/pxafb.c"
},
"digest": {
"line_hashes": [
"331231768851057453949700514902687751050",
"301499348710316175147440733004892977133",
"172585794260191973349832602893698594297",
"236562926645389460941662701024084863069"
],
"threshold": 0.9
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4a6921095eb04a900e0000da83d9475eb958e61e",
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2024-49924-3c38808d",
"target": {
"function": "pxafb_remove",
"file": "drivers/video/fbdev/pxafb.c"
},
"digest": {
"length": 407.0,
"function_hash": "48188582130387515049648668173492439564"
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e6897e299f57b103e999e62010b88e363b3eebae",
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2024-49924-717cacd1",
"target": {
"file": "drivers/video/fbdev/pxafb.c"
},
"digest": {
"line_hashes": [
"53303589229588408865558194745966247125",
"28396638306077995074507612864658352081",
"172585794260191973349832602893698594297",
"236562926645389460941662701024084863069"
],
"threshold": 0.9
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fdda354f60a576d52dcf90351254714681df4370",
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2024-49924-8adc99af",
"target": {
"file": "drivers/video/fbdev/pxafb.c"
},
"digest": {
"line_hashes": [
"331231768851057453949700514902687751050",
"301499348710316175147440733004892977133",
"172585794260191973349832602893698594297",
"236562926645389460941662701024084863069"
],
"threshold": 0.9
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6d0a07f68b66269e167def6c0b90a219cd3e7473",
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2024-49924-923b6075",
"target": {
"file": "drivers/video/fbdev/pxafb.c"
},
"digest": {
"line_hashes": [
"53303589229588408865558194745966247125",
"28396638306077995074507612864658352081",
"172585794260191973349832602893698594297",
"236562926645389460941662701024084863069"
],
"threshold": 0.9
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e657fa2df4429f3805a9b3e47fb1a4a1b02a72bd",
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2024-49924-99deafd6",
"target": {
"function": "pxafb_remove",
"file": "drivers/video/fbdev/pxafb.c"
},
"digest": {
"length": 420.0,
"function_hash": "302159975033061748069192567740747387449"
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e6897e299f57b103e999e62010b88e363b3eebae",
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2024-49924-a3cb283c",
"target": {
"function": "pxafb_remove",
"file": "drivers/video/fbdev/pxafb.c"
},
"digest": {
"length": 420.0,
"function_hash": "302159975033061748069192567740747387449"
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3a855764dbacbdb1cc51e15dc588f2d21c93e0e",
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2024-49924-a6f44049",
"target": {
"function": "pxafb_remove",
"file": "drivers/video/fbdev/pxafb.c"
},
"digest": {
"length": 407.0,
"function_hash": "48188582130387515049648668173492439564"
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4cda484e584be34d55ee17436ebf7ad11922b97a",
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2024-49924-bfa03ef2",
"target": {
"file": "drivers/video/fbdev/pxafb.c"
},
"digest": {
"line_hashes": [
"53303589229588408865558194745966247125",
"28396638306077995074507612864658352081",
"172585794260191973349832602893698594297",
"236562926645389460941662701024084863069"
],
"threshold": 0.9
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aaadc0cb05c999ccd8898a03298b7e5c31509b08",
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2024-49924-e458cf46",
"target": {
"function": "pxafb_remove",
"file": "drivers/video/fbdev/pxafb.c"
},
"digest": {
"length": 407.0,
"function_hash": "48188582130387515049648668173492439564"
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c0d416eb4bef705f699213cee94bf54b6acdacd",
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2024-49924-fc710a37",
"target": {
"file": "drivers/video/fbdev/pxafb.c"
},
"digest": {
"line_hashes": [
"53303589229588408865558194745966247125",
"28396638306077995074507612864658352081",
"172585794260191973349832602893698594297",
"236562926645389460941662701024084863069"
],
"threshold": 0.9
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4a6921095eb04a900e0000da83d9475eb958e61e",
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2024-49924-ff010ecb",
"target": {
"file": "drivers/video/fbdev/pxafb.c"
},
"digest": {
"line_hashes": [
"331231768851057453949700514902687751050",
"301499348710316175147440733004892977133",
"172585794260191973349832602893698594297",
"236562926645389460941662701024084863069"
],
"threshold": 0.9
},
"deprecated": false
}
]