AZL-51087
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-51087.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/AZL-51087
- Upstream
- Published
- 2024-10-21T20:15:18Z
- Modified
- 2026-04-01T05:17:39Z
- Severity
-
- 7.0 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- CVE-2024-50059 affecting package kernel for versions less than 6.6.57.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition
In the switchtec_ntb_add function, it can call switchtec_ntb_init_sndev function, then &sndev->check_link_status_work is bound with check_link_status_work. switchtec_ntb_link_notification may be called to start the work.
If we remove the module which will call switchtec_ntb_remove to make cleanup, it will free sndev through kfree(sndev), while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows:
CPU0 CPU1
| check_link_status_workswitchtec_ntb_remove | kfree(sndev); | | if (sndev->link_force_down) | // use sndev
Fix it by ensuring that the work is canceled before proceeding with the cleanup in switchtec_ntb_remove.
- References