AZL-46990
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-46990.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/AZL-46990
- Upstream
- Published
- 2024-07-12T13:15:12Z
- Modified
- 2026-04-01T05:15:50.149338Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- CVE-2024-39495 affecting package kernel for versions less than 5.15.162.2-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
greybus: Fix use-after-free bug in gbinterfacerelease due to race condition.
In gbinterfacecreate, &intf->modeswitchcompletion is bound with gbinterfacemodeswitchwork. Then it will be started by gbinterfacerequestmodeswitch. Here is the relevant code. if (!queuework(systemlongwq, &intf->modeswitch_work)) { ... }
If we call gbinterfacerelease to make cleanup, there may be an unfinished work. This function will call kfree to free the object "intf". However, if gbinterfacemodeswitchwork is scheduled to run after kfree, it may cause use-after-free error as gbinterfacemodeswitchwork will use the object "intf". The possible execution flow that may lead to the issue is as follows:
CPU0 CPU1
| gb_interface_create | gb_interface_request_mode_switchgbinterfacerelease | kfree(intf) (free) | | gbinterfacemodeswitchwork | mutex_lock(&intf->mutex) (use)
Fix it by canceling the work before kfree.
- References